GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-36930 (GCVE-0-2024-36930)

Vulnerability from cvelistv5 – Published: 2024-05-30 15:29 – Updated: 2026-05-11 20:17
VLAI
Title
spi: fix null pointer dereference within spi_sync
Summary
In the Linux kernel, the following vulnerability has been resolved: spi: fix null pointer dereference within spi_sync If spi_sync() is called with the non-empty queue and the same spi_message is then reused, the complete callback for the message remains set while the context is cleared, leading to a null pointer dereference when the callback is invoked from spi_finalize_current_message(). With function inlining disabled, the call stack might look like this: _raw_spin_lock_irqsave from complete_with_flags+0x18/0x58 complete_with_flags from spi_complete+0x8/0xc spi_complete from spi_finalize_current_message+0xec/0x184 spi_finalize_current_message from spi_transfer_one_message+0x2a8/0x474 spi_transfer_one_message from __spi_pump_transfer_message+0x104/0x230 __spi_pump_transfer_message from __spi_transfer_message_noqueue+0x30/0xc4 __spi_transfer_message_noqueue from __spi_sync+0x204/0x248 __spi_sync from spi_sync+0x24/0x3c spi_sync from mcp251xfd_regmap_crc_read+0x124/0x28c [mcp251xfd] mcp251xfd_regmap_crc_read [mcp251xfd] from _regmap_raw_read+0xf8/0x154 _regmap_raw_read from _regmap_bus_read+0x44/0x70 _regmap_bus_read from _regmap_read+0x60/0xd8 _regmap_read from regmap_read+0x3c/0x5c regmap_read from mcp251xfd_alloc_can_err_skb+0x1c/0x54 [mcp251xfd] mcp251xfd_alloc_can_err_skb [mcp251xfd] from mcp251xfd_irq+0x194/0xe70 [mcp251xfd] mcp251xfd_irq [mcp251xfd] from irq_thread_fn+0x1c/0x78 irq_thread_fn from irq_thread+0x118/0x1f4 irq_thread from kthread+0xd8/0xf4 kthread from ret_from_fork+0x14/0x28 Fix this by also setting message->complete to NULL when the transfer is complete.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 17:15 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ae7d2346dc89ae89a6e0aabe6037591a11e593c0 , < e005d6754e3e440257006795b687c4ad8733b493 (git)
Affected: ae7d2346dc89ae89a6e0aabe6037591a11e593c0 , < a30659f1576d2c8e62e7426232bb18b885fd951a (git)
Affected: ae7d2346dc89ae89a6e0aabe6037591a11e593c0 , < 2070d008cc08bff50a58f0f4d30f12d3ebf94c00 (git)
Affected: ae7d2346dc89ae89a6e0aabe6037591a11e593c0 , < 4756fa529b2f12b7cb8f21fe229b0f6f47190829 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.1.91 , ≤ 6.1.* (semver)
Unaffected: 6.6.31 , ≤ 6.6.* (semver)
Unaffected: 6.8.10 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:50.051Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e005d6754e3e440257006795b687c4ad8733b493"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a30659f1576d2c8e62e7426232bb18b885fd951a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2070d008cc08bff50a58f0f4d30f12d3ebf94c00"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4756fa529b2f12b7cb8f21fe229b0f6f47190829"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36930",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:15:54.638242Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:59.754Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e005d6754e3e440257006795b687c4ad8733b493",
              "status": "affected",
              "version": "ae7d2346dc89ae89a6e0aabe6037591a11e593c0",
              "versionType": "git"
            },
            {
              "lessThan": "a30659f1576d2c8e62e7426232bb18b885fd951a",
              "status": "affected",
              "version": "ae7d2346dc89ae89a6e0aabe6037591a11e593c0",
              "versionType": "git"
            },
            {
              "lessThan": "2070d008cc08bff50a58f0f4d30f12d3ebf94c00",
              "status": "affected",
              "version": "ae7d2346dc89ae89a6e0aabe6037591a11e593c0",
              "versionType": "git"
            },
            {
              "lessThan": "4756fa529b2f12b7cb8f21fe229b0f6f47190829",
              "status": "affected",
              "version": "ae7d2346dc89ae89a6e0aabe6037591a11e593c0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.91",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.31",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.10",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: fix null pointer dereference within spi_sync\n\nIf spi_sync() is called with the non-empty queue and the same spi_message\nis then reused, the complete callback for the message remains set while\nthe context is cleared, leading to a null pointer dereference when the\ncallback is invoked from spi_finalize_current_message().\n\nWith function inlining disabled, the call stack might look like this:\n\n  _raw_spin_lock_irqsave from complete_with_flags+0x18/0x58\n  complete_with_flags from spi_complete+0x8/0xc\n  spi_complete from spi_finalize_current_message+0xec/0x184\n  spi_finalize_current_message from spi_transfer_one_message+0x2a8/0x474\n  spi_transfer_one_message from __spi_pump_transfer_message+0x104/0x230\n  __spi_pump_transfer_message from __spi_transfer_message_noqueue+0x30/0xc4\n  __spi_transfer_message_noqueue from __spi_sync+0x204/0x248\n  __spi_sync from spi_sync+0x24/0x3c\n  spi_sync from mcp251xfd_regmap_crc_read+0x124/0x28c [mcp251xfd]\n  mcp251xfd_regmap_crc_read [mcp251xfd] from _regmap_raw_read+0xf8/0x154\n  _regmap_raw_read from _regmap_bus_read+0x44/0x70\n  _regmap_bus_read from _regmap_read+0x60/0xd8\n  _regmap_read from regmap_read+0x3c/0x5c\n  regmap_read from mcp251xfd_alloc_can_err_skb+0x1c/0x54 [mcp251xfd]\n  mcp251xfd_alloc_can_err_skb [mcp251xfd] from mcp251xfd_irq+0x194/0xe70 [mcp251xfd]\n  mcp251xfd_irq [mcp251xfd] from irq_thread_fn+0x1c/0x78\n  irq_thread_fn from irq_thread+0x118/0x1f4\n  irq_thread from kthread+0xd8/0xf4\n  kthread from ret_from_fork+0x14/0x28\n\nFix this by also setting message-\u003ecomplete to NULL when the transfer is\ncomplete."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:17:14.062Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e005d6754e3e440257006795b687c4ad8733b493"
        },
        {
          "url": "https://git.kernel.org/stable/c/a30659f1576d2c8e62e7426232bb18b885fd951a"
        },
        {
          "url": "https://git.kernel.org/stable/c/2070d008cc08bff50a58f0f4d30f12d3ebf94c00"
        },
        {
          "url": "https://git.kernel.org/stable/c/4756fa529b2f12b7cb8f21fe229b0f6f47190829"
        }
      ],
      "title": "spi: fix null pointer dereference within spi_sync",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36930",
    "datePublished": "2024-05-30T15:29:22.012Z",
    "dateReserved": "2024-05-30T15:25:07.070Z",
    "dateUpdated": "2026-05-11T20:17:14.062Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36930",
      "date": "2026-09-16",
      "epss": "0.00227",
      "percentile": "0.13563"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.0\", \"versionEndExcluding\": \"6.1.91\", \"matchCriteriaId\": \"54C26F9A-8376-491B-B07E-65C07B72B8D9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.31\", \"matchCriteriaId\": \"CDDB1F69-36AC-41C1-9192-E7CCEF5FFC00\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.8.10\", \"matchCriteriaId\": \"6A6B920C-8D8F-4130-86B4-AD334F4CF2E3\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nspi: fix null pointer dereference within spi_sync\\n\\nIf spi_sync() is called with the non-empty queue and the same spi_message\\nis then reused, the complete callback for the message remains set while\\nthe context is cleared, leading to a null pointer dereference when the\\ncallback is invoked from spi_finalize_current_message().\\n\\nWith function inlining disabled, the call stack might look like this:\\n\\n  _raw_spin_lock_irqsave from complete_with_flags+0x18/0x58\\n  complete_with_flags from spi_complete+0x8/0xc\\n  spi_complete from spi_finalize_current_message+0xec/0x184\\n  spi_finalize_current_message from spi_transfer_one_message+0x2a8/0x474\\n  spi_transfer_one_message from __spi_pump_transfer_message+0x104/0x230\\n  __spi_pump_transfer_message from __spi_transfer_message_noqueue+0x30/0xc4\\n  __spi_transfer_message_noqueue from __spi_sync+0x204/0x248\\n  __spi_sync from spi_sync+0x24/0x3c\\n  spi_sync from mcp251xfd_regmap_crc_read+0x124/0x28c [mcp251xfd]\\n  mcp251xfd_regmap_crc_read [mcp251xfd] from _regmap_raw_read+0xf8/0x154\\n  _regmap_raw_read from _regmap_bus_read+0x44/0x70\\n  _regmap_bus_read from _regmap_read+0x60/0xd8\\n  _regmap_read from regmap_read+0x3c/0x5c\\n  regmap_read from mcp251xfd_alloc_can_err_skb+0x1c/0x54 [mcp251xfd]\\n  mcp251xfd_alloc_can_err_skb [mcp251xfd] from mcp251xfd_irq+0x194/0xe70 [mcp251xfd]\\n  mcp251xfd_irq [mcp251xfd] from irq_thread_fn+0x1c/0x78\\n  irq_thread_fn from irq_thread+0x118/0x1f4\\n  irq_thread from kthread+0xd8/0xf4\\n  kthread from ret_from_fork+0x14/0x28\\n\\nFix this by also setting message-\u003ecomplete to NULL when the transfer is\\ncomplete.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: spi: corrige la desreferencia del puntero nulo dentro de spi_sync Si se llama a spi_sync() con la cola no vac\\u00eda y luego se reutiliza el mismo spi_message, la devoluci\\u00f3n de llamada completa para el mensaje permanece configurada mientras el el contexto se borra, lo que lleva a una desreferencia del puntero nulo cuando se invoca la devoluci\\u00f3n de llamada desde spi_finalize_current_message(). Con la funci\\u00f3n incorporada deshabilitada, la pila de llamadas podr\\u00eda verse as\\u00ed: _raw_spin_lock_irqsave from complete_with_flags+0x18/0x58 complete_with_flags from spi_complete+0x8/0xc spi_complete from spi_finalize_current_message+0xec/0x184 spi_finalize_current_message from spi_transfer_one_message+0x2 a8/0x474 spi_transfer_one_message de __spi_pump_transfer_message+0x104/0x230 __spi_pump_transfer_message de __spi_transfer_message_noqueue+0x30/0xc4 __spi_transfer_message_noqueue de __spi_sync+0x204/0x248 __spi_sync de spi_sync+0x24/0x3c spi_sync de mcp251xfd_regmap_crc_read+0x124/0x28c fd] mcp251xfd_regmap_crc_read [mcp251xfd] de _regmap_raw_read+0xf8/0x154 _regmap_raw_read de _regmap_bus_read+0x44/0x70 _regmap_bus_read de _regmap_read+ 0x60/0xd8 _regmap_read de regmap_read+0x3c/0x5c regmap_read de mcp251xfd_alloc_can_err_skb+0x1c/0x54 [mcp251xfd] mcp251xfd_alloc_can_err_skb [mcp251xfd] de mcp251xfd_irq+0x19 4/0xe70 [mcp251xfd] mcp251xfd_irq [mcp251xfd] de irq_thread_fn+0x1c/0x78 irq_thread_fn de irq_thread+0x118/0x1f4 irq_thread de kthread+0xd8/0xf4 kthread de ret_from_fork+0x14/0x28 Solucione este problema configurando tambi\\u00e9n mensaje-\u0026gt;completo en NULL cuando se complete la transferencia.\"}]",
      "id": "CVE-2024-36930",
      "lastModified": "2024-11-21T09:22:50.657",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-05-30T16:15:16.217",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/2070d008cc08bff50a58f0f4d30f12d3ebf94c00\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4756fa529b2f12b7cb8f21fe229b0f6f47190829\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a30659f1576d2c8e62e7426232bb18b885fd951a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e005d6754e3e440257006795b687c4ad8733b493\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/2070d008cc08bff50a58f0f4d30f12d3ebf94c00\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4756fa529b2f12b7cb8f21fe229b0f6f47190829\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a30659f1576d2c8e62e7426232bb18b885fd951a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e005d6754e3e440257006795b687c4ad8733b493\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-19T01:49:29.000Z",
      "cve": "CVE-2024-36930",
      "id": "msrc_CVE-2024-36930",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "spi: fix null pointer dereference within spi_sync",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-36930.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36930\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-30T16:15:16.217\",\"lastModified\":\"2026-06-17T07:37:23.250\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nspi: fix null pointer dereference within spi_sync\\n\\nIf spi_sync() is called with the non-empty queue and the same spi_message\\nis then reused, the complete callback for the message remains set while\\nthe context is cleared, leading to a null pointer dereference when the\\ncallback is invoked from spi_finalize_current_message().\\n\\nWith function inlining disabled, the call stack might look like this:\\n\\n  _raw_spin_lock_irqsave from complete_with_flags+0x18/0x58\\n  complete_with_flags from spi_complete+0x8/0xc\\n  spi_complete from spi_finalize_current_message+0xec/0x184\\n  spi_finalize_current_message from spi_transfer_one_message+0x2a8/0x474\\n  spi_transfer_one_message from __spi_pump_transfer_message+0x104/0x230\\n  __spi_pump_transfer_message from __spi_transfer_message_noqueue+0x30/0xc4\\n  __spi_transfer_message_noqueue from __spi_sync+0x204/0x248\\n  __spi_sync from spi_sync+0x24/0x3c\\n  spi_sync from mcp251xfd_regmap_crc_read+0x124/0x28c [mcp251xfd]\\n  mcp251xfd_regmap_crc_read [mcp251xfd] from _regmap_raw_read+0xf8/0x154\\n  _regmap_raw_read from _regmap_bus_read+0x44/0x70\\n  _regmap_bus_read from _regmap_read+0x60/0xd8\\n  _regmap_read from regmap_read+0x3c/0x5c\\n  regmap_read from mcp251xfd_alloc_can_err_skb+0x1c/0x54 [mcp251xfd]\\n  mcp251xfd_alloc_can_err_skb [mcp251xfd] from mcp251xfd_irq+0x194/0xe70 [mcp251xfd]\\n  mcp251xfd_irq [mcp251xfd] from irq_thread_fn+0x1c/0x78\\n  irq_thread_fn from irq_thread+0x118/0x1f4\\n  irq_thread from kthread+0xd8/0xf4\\n  kthread from ret_from_fork+0x14/0x28\\n\\nFix this by also setting message-\u003ecomplete to NULL when the transfer is\\ncomplete.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: spi: corrige la desreferencia del puntero nulo dentro de spi_sync Si se llama a spi_sync() con la cola no vac\u00eda y luego se reutiliza el mismo spi_message, la devoluci\u00f3n de llamada completa para el mensaje permanece configurada mientras el el contexto se borra, lo que lleva a una desreferencia del puntero nulo cuando se invoca la devoluci\u00f3n de llamada desde spi_finalize_current_message(). Con la funci\u00f3n incorporada deshabilitada, la pila de llamadas podr\u00eda verse as\u00ed: _raw_spin_lock_irqsave from complete_with_flags+0x18/0x58 complete_with_flags from spi_complete+0x8/0xc spi_complete from spi_finalize_current_message+0xec/0x184 spi_finalize_current_message from spi_transfer_one_message+0x2 a8/0x474 spi_transfer_one_message de __spi_pump_transfer_message+0x104/0x230 __spi_pump_transfer_message de __spi_transfer_message_noqueue+0x30/0xc4 __spi_transfer_message_noqueue de __spi_sync+0x204/0x248 __spi_sync de spi_sync+0x24/0x3c spi_sync de mcp251xfd_regmap_crc_read+0x124/0x28c fd] mcp251xfd_regmap_crc_read [mcp251xfd] de _regmap_raw_read+0xf8/0x154 _regmap_raw_read de _regmap_bus_read+0x44/0x70 _regmap_bus_read de _regmap_read+ 0x60/0xd8 _regmap_read de regmap_read+0x3c/0x5c regmap_read de mcp251xfd_alloc_can_err_skb+0x1c/0x54 [mcp251xfd] mcp251xfd_alloc_can_err_skb [mcp251xfd] de mcp251xfd_irq+0x19 4/0xe70 [mcp251xfd] mcp251xfd_irq [mcp251xfd] de irq_thread_fn+0x1c/0x78 irq_thread_fn de irq_thread+0x118/0x1f4 irq_thread de kthread+0xd8/0xf4 kthread de ret_from_fork+0x14/0x28 Solucione este problema configurando tambi\u00e9n mensaje-\u0026gt;completo en NULL cuando se complete la transferencia.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/spi/spi.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ae7d2346dc89ae89a6e0aabe6037591a11e593c0\",\"lessThan\":\"e005d6754e3e440257006795b687c4ad8733b493\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ae7d2346dc89ae89a6e0aabe6037591a11e593c0\",\"lessThan\":\"a30659f1576d2c8e62e7426232bb18b885fd951a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ae7d2346dc89ae89a6e0aabe6037591a11e593c0\",\"lessThan\":\"2070d008cc08bff50a58f0f4d30f12d3ebf94c00\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ae7d2346dc89ae89a6e0aabe6037591a11e593c0\",\"lessThan\":\"4756fa529b2f12b7cb8f21fe229b0f6f47190829\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/spi/spi.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.91\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.31\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.10\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:15:54.638242Z\",\"id\":\"CVE-2024-36930\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0\",\"versionEndExcluding\":\"6.1.91\",\"matchCriteriaId\":\"54C26F9A-8376-491B-B07E-65C07B72B8D9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.31\",\"matchCriteriaId\":\"CDDB1F69-36AC-41C1-9192-E7CCEF5FFC00\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.10\",\"matchCriteriaId\":\"6A6B920C-8D8F-4130-86B4-AD334F4CF2E3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2070d008cc08bff50a58f0f4d30f12d3ebf94c00\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4756fa529b2f12b7cb8f21fe229b0f6f47190829\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a30659f1576d2c8e62e7426232bb18b885fd951a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e005d6754e3e440257006795b687c4ad8733b493\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2070d008cc08bff50a58f0f4d30f12d3ebf94c00\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4756fa529b2f12b7cb8f21fe229b0f6f47190829\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a30659f1576d2c8e62e7426232bb18b885fd951a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e005d6754e3e440257006795b687c4ad8733b493\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T07:55:30+00:00",
      "cve": "CVE-2024-36930",
      "id": "CVE-2024-36930",
      "initial_release_date": "2024-05-30T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "50",
      "product_status:known_not_affected": "70",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: spi: fix null pointer dereference within spi_sync",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-36930.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T02:35:11Z",
      "cve": "CVE-2024-36930",
      "id": "CVE-2024-36930",
      "initial_release_date": "2024-06-04T02:25:35Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "332",
      "product_status:recommended": "359",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-36930",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-36930.json",
      "version": "84"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e005d6754e3e440257006795b687c4ad8733b493\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a30659f1576d2c8e62e7426232bb18b885fd951a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2070d008cc08bff50a58f0f4d30f12d3ebf94c00\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4756fa529b2f12b7cb8f21fe229b0f6f47190829\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:43:50.051Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36930\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:15:54.638242Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:27.378Z\"}}], \"cna\": {\"title\": \"spi: fix null pointer dereference within spi_sync\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"ae7d2346dc89ae89a6e0aabe6037591a11e593c0\", \"lessThan\": \"e005d6754e3e440257006795b687c4ad8733b493\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ae7d2346dc89ae89a6e0aabe6037591a11e593c0\", \"lessThan\": \"a30659f1576d2c8e62e7426232bb18b885fd951a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ae7d2346dc89ae89a6e0aabe6037591a11e593c0\", \"lessThan\": \"2070d008cc08bff50a58f0f4d30f12d3ebf94c00\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ae7d2346dc89ae89a6e0aabe6037591a11e593c0\", \"lessThan\": \"4756fa529b2f12b7cb8f21fe229b0f6f47190829\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/spi/spi.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.91\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.31\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/spi/spi.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e005d6754e3e440257006795b687c4ad8733b493\"}, {\"url\": \"https://git.kernel.org/stable/c/a30659f1576d2c8e62e7426232bb18b885fd951a\"}, {\"url\": \"https://git.kernel.org/stable/c/2070d008cc08bff50a58f0f4d30f12d3ebf94c00\"}, {\"url\": \"https://git.kernel.org/stable/c/4756fa529b2f12b7cb8f21fe229b0f6f47190829\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nspi: fix null pointer dereference within spi_sync\\n\\nIf spi_sync() is called with the non-empty queue and the same spi_message\\nis then reused, the complete callback for the message remains set while\\nthe context is cleared, leading to a null pointer dereference when the\\ncallback is invoked from spi_finalize_current_message().\\n\\nWith function inlining disabled, the call stack might look like this:\\n\\n  _raw_spin_lock_irqsave from complete_with_flags+0x18/0x58\\n  complete_with_flags from spi_complete+0x8/0xc\\n  spi_complete from spi_finalize_current_message+0xec/0x184\\n  spi_finalize_current_message from spi_transfer_one_message+0x2a8/0x474\\n  spi_transfer_one_message from __spi_pump_transfer_message+0x104/0x230\\n  __spi_pump_transfer_message from __spi_transfer_message_noqueue+0x30/0xc4\\n  __spi_transfer_message_noqueue from __spi_sync+0x204/0x248\\n  __spi_sync from spi_sync+0x24/0x3c\\n  spi_sync from mcp251xfd_regmap_crc_read+0x124/0x28c [mcp251xfd]\\n  mcp251xfd_regmap_crc_read [mcp251xfd] from _regmap_raw_read+0xf8/0x154\\n  _regmap_raw_read from _regmap_bus_read+0x44/0x70\\n  _regmap_bus_read from _regmap_read+0x60/0xd8\\n  _regmap_read from regmap_read+0x3c/0x5c\\n  regmap_read from mcp251xfd_alloc_can_err_skb+0x1c/0x54 [mcp251xfd]\\n  mcp251xfd_alloc_can_err_skb [mcp251xfd] from mcp251xfd_irq+0x194/0xe70 [mcp251xfd]\\n  mcp251xfd_irq [mcp251xfd] from irq_thread_fn+0x1c/0x78\\n  irq_thread_fn from irq_thread+0x118/0x1f4\\n  irq_thread from kthread+0xd8/0xf4\\n  kthread from ret_from_fork+0x14/0x28\\n\\nFix this by also setting message-\u003ecomplete to NULL when the transfer is\\ncomplete.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.91\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.31\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.10\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:12:18.730Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36930\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:12:18.730Z\", \"dateReserved\": \"2024-05-30T15:25:07.070Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-30T15:29:22.012Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.