CVE-2024-57852

What it actually does

Missing NULL check on return value from qcom_scm_get_tzmem_pool() allows a NULL pointer dereference in the Qualcomm SCM SMC path.

Why it matters to the business

Kernel instability or crash on affected Qualcomm-based Linux systems can interrupt device operation and require reboots or maintenance.

How an attack unfolds

An attacker with the ability to trigger SCM firmware calls on a system lacking a properly initialized SCM device can cause the kernel to dereference a NULL pointer, leading to a crash.

How to fix it

Update the Linux kernel to commit adc218676eef25575469234709c2d87185ca223a or later; rebuild and deploy the updated kernel image on affected Qualcomm platforms.

How to confirm the fix worked

Verify the presence of the fix commit in the kernel source tree or confirm the running kernel version contains the patch; test SCM initialization paths under missing-device conditions.

Typical attack path

1. Identify or create conditions where qcom_scm_get_tzmem_pool returns NULL
2. Invoke a Qualcomm SCM SMC operation that does not guard the returned pointer
3. Trigger NULL dereference resulting in kernel panic or oops

How to detect it

Search kernel logs for oops or panic messages referencing qcom_scm_get_tzmem_pool or NULL dereference in scm-smc paths; correlate with device boot sequences lacking SCM device registration.

What your security team should do

• Prioritize kernel updates on all Qualcomm-based Linux deployments within standard change windows
• Monitor upstream stable kernel releases for backports of the fix
• Review device initialization logs for SCM-related NULL dereference oops after patching