CVE-2024-26784

What it actually does

NULL pointer dereference in the scmi_perf_domain module remove path when the device tree lacks the expected power-domain-cells property, causing an oops during module unload because structures were never initialized after an early probe exit.

Why it matters to the business

Unloading the affected kernel module on systems with incomplete device-tree power-domain configuration triggers a kernel crash, leading to denial of service and potential loss of availability for dependent services; low exploitability but high operational impact on affected embedded or ARM platforms.

How an attack unfolds

An attacker with local access triggers module unload (via rmmod or driver detach) on a system whose device tree omits the power-domain-cells property; the remove callback runs without initialized structures and dereferences a NULL pointer, crashing the kernel.

How to fix it

Update to a kernel containing the fix that adds an early return check in the remove callback; apply the corrected package versions for any affected distributions listed (e.g., updated firefox-esr or thunderbird packages where backported).

How to confirm the fix worked

Confirm the presence of the guard check in scmi_perf_domain_remove that bails out when structures are uninitialized; verify module unload completes without oops on systems with missing DT property.

Typical attack path

1. Identify a target system running the vulnerable scmi_perf_domain driver with incomplete DT power-domain configuration
2. Obtain local access or sufficient privileges to unload the module
3. Execute module removal or driver detach
4. Trigger NULL dereference in scmi_perf_domain_remove resulting in kernel oops

How to detect it

Search kernel logs for the exact call trace containing scmi_perf_domain_remove followed by device_remove and driver_detach; look for the NULL dereference oops with the provided register dump pattern during module exit.

• scmi_perf_domain_remove+0x28/0x70
• scmi_dev_remove+0x28/0x40
• b9400a80 in the faulting instruction of the oops

What your security team should do

• Prioritize kernel updates on ARM systems using SCMI performance domains
• Audit device trees for missing power-domain-cells properties before module unload testing
• Monitor for kernel oops reports referencing scmi_perf_domain_remove during driver detach operations