CVE-2024-26965

What it actually does

Missing terminating empty element in frequency table arrays allows out-of-bounds access during traversal by qcom_find_freq() and qcom_find_freq_floor().

Why it matters to the business

Potential kernel instability or crashes on affected Qualcomm MSM8974-based systems may cause device reboots, service disruption, and require emergency patching across Linux deployments.

How an attack unfolds

An attacker with local access triggers clock frequency lookup functions that traverse unterminated tables, reading past array bounds and potentially causing memory corruption or denial of service.

How to fix it

Apply the fix from commit 99740c4791dc8019b0d758c5389ca6d1c0604d95 in the Linux kernel stable tree to add the required terminating entry to all affected frequency table arrays.

How to confirm the fix worked

Inspect clk/qcom/mmcc-msm8974.c source for empty-element termination at the end of each frequency table array and confirm the presence of the cited commit in the running kernel.

Typical attack path

1. Identify system using msm8974 mmcc clock driver
2. Trigger clock rate queries via user-space interfaces or drivers
3. Force traversal of incomplete frequency tables
4. Induce out-of-bounds read leading to fault or corruption

How to detect it

Review kernel logs and dmesg for oops, warnings, or stack traces referencing qcom_find_freq or mmcc-msm8974 frequency table access after clock rate changes.

What your security team should do

• Upgrade all affected Linux kernels to include commit 99740c4791dc8019b0d758c5389ca6d1c0604d95 immediately
• Prioritize systems running msm8974 hardware or using the mmcc-msm8974 driver
• Monitor kernel logs for oops or out-of-bounds warnings related to clock frequency tables