CVE-2024-42282

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-42282
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42282.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-42282
Downstream
Published
2024-08-17T09:08:49Z
Modified
2025-10-22T00:58:20.744792Z
Summary
net: mediatek: Fix potential NULL pointer dereference in dummy net_device handling
Details

In the Linux kernel, the following vulnerability has been resolved:

net: mediatek: Fix potential NULL pointer dereference in dummy net_device handling

Move the freeing of the dummy netdevice from mtkfreedev() to mtkremove().

Previously, if allocnetdevdummy() failed in mtkprobe(), eth->dummydev would be NULL. The error path would then call mtkfreedev(), which in turn called freenetdev() assuming dummydev was allocated (but it was not), potentially causing a NULL pointer dereference.

By moving freenetdev() to mtkremove(), we ensure it's only called when mtkprobe() has succeeded and dummydev is fully allocated. This addresses a potential NULL pointer dereference detected by Smatch[1].

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
b209bd6d0bffb8991aba568e2d9a892c86a1a43c
Fixed
af6bd5c9901b13a26eaf4d57d97a813297791596
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
b209bd6d0bffb8991aba568e2d9a892c86a1a43c
Fixed
16f3a28cf5f876a7f3550d8f4c870a7b41bcfaef

Affected versions

v6.*

v6.10
v6.10-rc1
v6.10-rc2
v6.10-rc3
v6.10-rc4
v6.10-rc5
v6.10-rc6
v6.10-rc7
v6.10.1
v6.10.2
v6.9
v6.9-rc5
v6.9-rc6
v6.9-rc7

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.10.0
Fixed
6.10.3