CVE-2024-26968

What it actually does

Missing terminating empty element in frequency table arrays allows out-of-bounds reads during traversal by qcom_find_freq() and qcom_find_freq_floor() on IPQ9574 GCC clocks.

Why it matters to the business

Kernel instability or crashes on affected networking SoCs can interrupt device operation and require unplanned reboots or firmware updates.

How an attack unfolds

An attacker with local access triggers clock frequency lookup functions that walk the unterminated tables, causing out-of-bounds memory access that may lead to denial of service.

How to fix it

Apply the fix from commit 0204247cf3669b6021fb745c3b7f37ae392ab19c in the Linux kernel tree for the gcc-ipq9574 driver and rebuild or upgrade to a kernel containing this change.

How to confirm the fix worked

Inspect the frequency table definitions in drivers/clk/qcom/gcc-ipq9574.c to confirm each array ends with an empty element and verify the presence of commit 0204247cf3669b6021fb745c3b7f37ae392ab19c in the running kernel.

Typical attack path

1. Obtain local code execution or shell on the target device
2. Invoke clock rate query or frequency selection that calls qcom_find_freq()
3. Traverse the incomplete frequency table causing out-of-bounds access
4. Trigger kernel panic or memory corruption

How to detect it

Review kernel logs for oops or BUG reports involving qcom_find_freq or gcc-ipq9574 clock code; no public exploitation artifacts are known.

What your security team should do

• Patch affected kernels to the fixed commit as soon as vendor images are available
• Monitor for kernel oops or crashes on IPQ9574-based devices
• Limit local access on exposed systems until patched