Review reviewHigh

CVE-2024-35919

Linux Linux, linux_kernel, linux kernel

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: adding lock to protect encoder context list Add a lock for the ctx_list, to avoid accessing a NULL pointer within the 'vpu_enc_ipi_handler' function when the ctx_list has been deleted due to an unexpected behavior on the SCP IP block.

CVSS: 7.8
EPSS: 0.24%
CISA KEV: Not listed
Published: 2024.05.19

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.24%

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Linux Linux, linux_kernel, linux kernel
Affected versions: >= 1972e32431ed14682909ad568c6fd660572ae6ab < 41671f0c0182b2bae74ca7e3b0f155559e3e2fc5, >= 1972e32431ed14682909ad568c6fd660572ae6ab < 51c84a8aac6e3b59af2b0e92ba63cabe2e641a2d, >= 1972e32431ed14682909ad568c6fd660572ae6ab < afaaf3a0f647a24a7bf6a2145d8ade37baaf75ad, >= 6.6, >= 1972e32431ed < 41671f0c0182, >= 1972e32431ed < 51c84a8aac6e, >= 1972e32431ed < afaaf3a0f647, < 6.6*, >= 6.6.27 <= 6.6*, >= 6.8.6 <= 6.8*, >= 6.9, >= 6.6 < 6.6.27, >= 6.7 < 6.8.6, 6.9
Fixed versions: 6.6.27, 6.8.6

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux Linux, linux_kernel, linux kernel and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-476