CVE-2024-26967

What it actually does

Missing empty-element terminator in frequency table arrays allows out-of-bounds read when qcom_find_freq() or qcom_find_freq_floor() traverse past the last valid entry.

Why it matters to the business

Kernel instability or memory corruption on affected Qualcomm Snapdragon platforms can cause device crashes, degraded multimedia/camera functionality, and unplanned downtime for embedded or mobile Linux deployments.

How an attack unfolds

An attacker with local execution or the ability to trigger camera clock-controller frequency lookups can cause the traversal functions to read past the array bounds, potentially leaking kernel memory or inducing a crash; no public in-the-wild exploitation is known.

How to fix it

Upgrade to Linux kernel 6.8.3 or later, or apply commit 93ff48729211dae55df5d216023be4528d29babb in the stable tree; rebuild and reboot with the corrected camcc-sc8280xp driver.

How to confirm the fix worked

Confirm the presence of an empty (zeroed) sentinel entry at the end of the frequency tables in drivers/clk/qcom/camcc-sc8280xp.c and verify the running kernel contains commit 93ff48729211 or is version 6.8.3 or newer.

Typical attack path

1. Obtain local code execution or trigger camera/clock-controller initialization on a vulnerable kernel
2. Force repeated calls to qcom_find_freq() or qcom_find_freq_floor() against the unterminated camcc-sc8280xp tables
3. Read or write past the end of the array, resulting in kernel oops or information leak

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for oops or warning messages referencing qcom_find_freq, camcc-sc8280xp, or frequency table access violations around camera or multimedia initialization.

What your security team should do

• Apply the kernel update to 6.8.3 or the backported commit within the next maintenance window
• Prioritize devices using sc8280xp or similar Qualcomm camera clock controllers
• Monitor vendor firmware releases that incorporate the fix for embedded products