CVE-2024-53069

What it actually does

NULL pointer dereference in the Linux kernel Qualcomm SCM firmware driver when __scm is NULL because no SCM device-tree entry exists and the driver is never probed.

Why it matters to the business

Systems running the listed old Ubuntu kernel packages on Qualcomm hardware may experience kernel crashes or denial of service during SCM calls; the packages are long EOL so patch availability is limited and urgency is low.

How an attack unfolds

An attacker with the ability to trigger SCM calls on an affected system invokes the interface before the driver has initialized, causing the kernel to dereference a NULL pointer and resulting in a crash or memory corruption opportunity.

How to fix it

Upgrade to the fixed package versions listed for each affected Ubuntu release (for example linux 3.13.0-79.123 on 14.04 LTS, linux 4.4.0-2.16 on 16.04 LTS, and the corresponding fixed versions for linux-aws, linux-hwe, linux-raspi2, etc.).

How to confirm the fix worked

Confirm the running kernel version matches or exceeds one of the listed fixed package versions and verify that SCM calls no longer trigger NULL dereference paths via kernel source inspection or targeted testing.

Typical attack path

1. Identify a system running an affected Ubuntu kernel package with Qualcomm hardware but no SCM device-tree entry.
2. Trigger an SCM call that reaches the vulnerable code path while __scm remains NULL.
3. Cause kernel NULL dereference leading to panic or exploitable memory corruption state.

How to detect it

Review kernel logs for oops or panic messages referencing qcom_scm or __scm NULL dereference on systems running the affected packages; correlate with processes that invoke firmware SCM calls.

What your security team should do

• Apply the exact fixed package versions for each affected Ubuntu release immediately on any remaining supported systems.
• Migrate workloads off the EOL 14.04 and 16.04 kernel packages to a currently supported Ubuntu release.
• Audit device-tree configurations to ensure SCM nodes are present where required to avoid the NULL driver condition.