CVE-2024-26599

What it actually does

Out-of-bounds memory access occurs in of_pwm_single_xlate() when args_count equals 2, because the code incorrectly indexes args[2] instead of reading flags from args[1], resulting in reads from undefined memory.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel memory corruption, leading to crashes, denial of service, or potential privilege escalation on servers, embedded devices, and cloud instances that use device-tree PWM configuration.

How an attack unfolds

An attacker with local access supplies a crafted device tree blob containing a PWM node with args_count set to 2; during kernel initialization the faulty translation function performs an out-of-bounds read, corrupting kernel memory and allowing further exploitation to gain elevated privileges.

How to fix it

Upgrade the Linux kernel to the commit 7b85554c7c2aee91171e038e4d5442ffa130b282 or later stable releases that contain the corrected of_pwm_single_xlate() implementation.

How to confirm the fix worked

Verify the running kernel contains commit 7b85554c7c2aee91171e038e4d5442ffa130b282; inspect kernel source for the fixed indexing of args[1] and test PWM device registration with args_count==2.

Typical attack path

1. Obtain local shell or code execution on target Linux system
2. Prepare malicious device-tree overlay or boot-time DTB with PWM args_count==2
3. Trigger PWM device registration or probe path that calls of_pwm_single_xlate()
4. Exploit resulting out-of-bounds read for memory corruption and privilege escalation

How to detect it

Review kernel logs for oops or panic messages referencing of_pwm_single_xlate or PWM device-tree parsing around system boot; examine device-tree blobs loaded at runtime for PWM nodes with args_count set to 2.

What your security team should do

• Prioritize kernel updates on all systems that boot with device-tree PWM nodes
• Monitor vendor advisories for backported fixes in distribution kernels
• Apply defense-in-depth: restrict local unprivileged access until patches are deployed