CVE-2024-26998

In the Linux kernel, the following vulnerability has been resolved: serial: core: Clearing the circular buffer before NULLifying it The circular buffer is NULLified in uart_tty_port_shutdown() under the spin lock. However, the PM or other timer based callbacks may still trigger after this event without knowning that buffer pointer is not valid. Since the serial code is a bit inconsistent in checking the buffer state (some rely on the head-tail positions, some on the buffer pointer), it's better to have both aligned, i.e. buffer pointer to be NULL and head-tail possitions to be the same, meaning it's empty. This will prevent asynchronous calls to dereference NULL pointer as reported recently in 8250 case: BUG: kernel NULL pointer dereference, address: 00000cf5 Workqueue: pm pm_runtime_work EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809) ... ? serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809) __start_tx (drivers/tty/serial/8250/8250_port.c:1551) serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654) serial_port_runtime_suspend (include/linux/serial_core.h:667 drivers/tty/serial/serial_port.c:63) __rpm_callback (drivers/base/power/runtime.c:393) ? serial_port_remove (drivers/tty/serial/serial_port.c:50) rpm_suspend (drivers/base/power/runtime.c:447) The proposed change will prevent ->start_tx() to be called during suspend on shut down port.

• CWE-476

• https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350Patch
• https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940Patch
• https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985Patch
• https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350Patch
• https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940Patch
• https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985Patch
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/

Published

May 1, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-26992In the Linux kernel, the following vulnerability has been re…3.3
• CVE-2024-26993In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-26994In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-26995In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-26996In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-26997In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-26999In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-2700A vulnerability was found in the quarkus-core component. Qua…7
• CVE-2024-27000In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-27001In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-27002In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-27003In the Linux kernel, the following vulnerability has been re…5.5