CVE-2024-26942

What it actually does

NULL pointer dereference in the at803x PHY driver during at8031 probe, where the priv structure is accessed before allocation in phydev, causing writes to invalid memory addresses for is_1000basex and is_fiber flags.

Why it matters to the business

Kernel panic on systems with affected Qualcomm AT8031 PHY hardware during network interface initialization or boot, leading to unplanned downtime and potential loss of network connectivity on Linux servers or embedded devices.

How an attack unfolds

An attacker with local access loads or triggers the at803x driver on systems using the AT8031 PHY, causing the probe function to dereference an unallocated priv pointer and panic the kernel; no remote or unauthenticated path exists.

How to fix it

Update to Linux kernel 6.8.3 or later, or apply the fix from commit a8a296ad9957b845b89bcf48be1cf8c74875ecc3 in the stable git tree; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify the running kernel version is at least 6.8.3 or contains commit a8a296ad9957b845b89bcf48be1cf8c74875ecc3; test PHY probe on AT8031 hardware and confirm no panic occurs during interface initialization.

Typical attack path

1. Obtain local user access on a Linux system with AT8031 PHY hardware
2. Trigger PHY driver initialization via network interface bring-up or module load
3. Cause at8031_probe to execute the flawed code path before priv allocation
4. Induce kernel panic through invalid memory write

How to detect it

Review kernel logs for oops or panic messages referencing at803x_probe or phydev priv dereference around network initialization; correlate with hardware presence of AT8031 PHYs.

What your security team should do

• Prioritize patching kernel on all systems with Qualcomm AT803x PHYs within standard maintenance windows
• Monitor vendor kernel updates for backports to older LTS branches
• Restrict local access on affected hardware until patched