Bug 2266257 (CVE-2024-26604)

Summary:	CVE-2024-26604 kernel: null pointer dereference in kobject
Product:	[Other] Security Response	Reporter:	Rohit Keshri <rkeshri>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, allarkin, aquini, bhu, chwhite, cye, cyin, dbohanno, debarbos, dfreiber, drow, dvlasenk, esandeen, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, ldoskova, lgoncalv, lzampier, mleitner, mmilgram, mstowell, nmurray, ptalbert, rparrazo, rrobaina, rvrbovsk, scweaver, sukulkar, tglozar, vkumar, wcosta, williams, wmealing, ycote, ykopkova, zhijwang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in the Linux kernel. A NULL pointer dereference exists in kobject.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2266262
Bug Blocks:	2266258

Description Rohit Keshri 2024-02-27 11:20:24 UTC

In the Linux kernel, the following vulnerability has been resolved:

Revert "kobject: Remove redundant checks for whether ktype is NULL"

This reverts commit 1b28cb81dab7c1eedc6034206f4e8d644046ad31.

It is reported to cause problems, so revert it for now until the root
cause can be found.

https://git.kernel.org/stable/c/3ca8fbabcceb8bfe44f7f50640092fd8f1de375c
https://git.kernel.org/stable/c/7f414d306320f837cc3df96cf52161cb8290fb1b
https://git.kernel.org/stable/c/b746d52ce7bcac325a2fa264216ead85b7fbbfaa

Comment 1 Rohit Keshri 2024-02-27 11:41:45 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2266262]

Comment 6 Alex 2024-06-09 12:51:34 UTC

The result of automatic check (that is developed by Alexander Larkin) for this CVE-2024-26604 is: 	SKIP	The Fixes patch not applied yet, so unlikely that actual: 1b28cb81dab7c1eedc6034206f4e8d644046ad31	YES			NO	NO	unknown (where first YES/NO value means if related sources built).