CVE-2024-26751

What it actually does

Missing terminator in gpiod_lookup_table allows gpio_find() to loop past table bounds on non-existent con_id, causing out-of-bounds access and kernel oops on ARM ep93xx.

Why it matters to the business

Potential kernel crashes on affected ARM ep93xx embedded devices leading to system instability and denial of service; low exploitability reduces urgency but still requires patching in relevant kernels.

How an attack unfolds

An attacker able to trigger gpio_find with a crafted non-existent con_id causes the lookup to fail to terminate, resulting in invalid memory access and kernel crash; no named threat actors or ransomware use observed.

How to fix it

Update the Linux kernel to a version containing commit 9e200a06ae2abb321939693008290af32b33dd6e which adds the required terminator to the gpiod_lookup_table.

How to confirm the fix worked

Inspect the gpiod_lookup_table definition for a proper sentinel entry and confirm absence of oops when gpio_find receives unknown con_id values.

Typical attack path

1. Locate code paths calling gpio_find on ep93xx hardware
2. Supply a con_id absent from the lookup table
3. Trigger the unbounded loop and oops

How to detect it

Monitor kernel logs and oops/panic reports mentioning ep93xx or gpio_find for evidence of prior triggering; no widespread exploitation indicators exist.

What your security team should do

• Apply the referenced kernel commit or newer stable release containing the fix
• Prioritize updates on ep93xx-based systems
• Review kernel logs for gpio-related oops after deployment