CVE-2024-27063

leds: trigger: netdev: Fix kernel panic on interface rename trig notify

MEDIUM
5.5
CVSS Score
Published: May 1, 2024 at 01:00 PM UTC
Updated: June 17, 2026 at 07:19 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: leds: trigger: netdev: Fix kernel panic on interface rename trig notify Commit d5e01266e7f5 ("leds: trigger: netdev: add additional specific link speed mode") in the various changes, reworked the way to set the LINKUP mode in commit cee4bd16c319 ("leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on dev rename") and moved it to a generic function. This changed the logic where, in the previous implementation the dev from the trigger event was used to check if the carrier was ok, but in the new implementation with the generic function, the dev in trigger_data is used instead. This is problematic and cause a possible kernel panic due to the fact that the dev in the trigger_data still reference the old one as the new one (passed from the trigger event) still has to be hold and saved in the trigger_data struct (done in the NETDEV_REGISTER case). On calling of get_device_state(), an invalid net_dev is used and this cause a kernel panic. To handle this correctly, move the call to get_device_state() after the new net_dev is correctly set in trigger_data (in the NETDEV_REGISTER case) and correctly parse the new dev.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

6.5 ≤ v < 6.6.246.5 ≤ v < 6.7.126.5 ≤ v < 6.8.36.5 ≤ v < 6.96.7 ≤ v < 6.7.126.8 ≤ v < 6.8.36.5d5e01266e7f5fa12400d4c8aa4e86fe89dcc61e9
Vendor states this is fixed in 10f2af1af8ab8a7064f193446abd5579d3def7e3 (fixed)
Vendor states this is fixed in 3f360227cb46edb2cd2494128e1e06ed5768a62e (fixed)
Vendor states this is fixed in 415798bc07dd1c1ae3a656aa026580816e0b9fe8 (fixed)
Vendor states this is fixed in acd025c7a7d151261533016a6ca2d38f2de04e87 (fixed)
Vendor states this is fixed in 6.5 (unaffected)
Vendor states this is fixed in 6.6.24 (unaffected)
Vendor states this is fixed in 6.7.12 (unaffected)
Vendor states this is fixed in 6.8.3 (unaffected)
Vendor states this is fixed in 6.9 (unaffected)

References (4)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/10f2af1af8ab8a7064f193446abd5579d3def7e3
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3f360227cb46edb2cd2494128e1e06ed5768a62e
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/415798bc07dd1c1ae3a656aa026580816e0b9fe8
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/acd025c7a7d151261533016a6ca2d38f2de04e87

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card