CVE-2024-39461

What it actually does

Incorrect initialization order where the num member of clk_hw_onecell_data is assigned after the hws array is accessed, triggering UBSAN array-index-out-of-bounds warnings due to __counted_by annotation seeing zero elements.

Why it matters to the business

May produce kernel warnings on Raspberry Pi systems during clock discovery, increasing noise in logs and complicating debugging on affected kernel builds; low urgency given absent KEV status and minimal EPSS.

How an attack unfolds

No practical exploitation path exists; the flaw is a static initialization sequencing error exposed only under bounds sanitizer instrumentation rather than a runtime memory corruption that threat actors could leverage.

How to fix it

Update to a kernel containing the fix that moves the num assignment before the first hws access; no downstream Mattermost package updates apply to this Linux kernel issue.

How to confirm the fix worked

Rebuild with CONFIG_UBSAN_BOUNDS and confirm absence of the array-index-out-of-bounds warning during raspberrypi_discover_clocks execution.

Typical attack path

1. Boot kernel on Raspberry Pi hardware with UBSAN enabled
2. Call raspberrypi_discover_clocks()
3. Access hws array before num is initialized
4. Trigger sanitizer warning at drivers/clk/bcm/clk-raspberrypi.c:374

How to detect it

Inspect kernel boot logs and dmesg for UBSAN array-index-out-of-bounds messages referencing clk-raspberrypi.c; no network or file-based IOCs are associated.

What your security team should do

• Apply the upstream kernel commit that reorders num initialization
• Monitor kernel logs for UBSAN warnings on Raspberry Pi deployments
• Prioritize standard kernel updates over any unrelated Mattermost patches