CVE-2024-27047

A vulnerability was found in the Linux kernel's net driver phy_device.c in the phy_get_internal_delay() function, where a lack of proper checks can cause a potential NULL pointer dereference to occur when the function attempts to access an empty array. The error occurs if the driver calls phy_get_internal_delay() without defining delay_values and rx-internal-delay-ps or tx-internal-delay-ps is set to 0 in the device-tree. This flaw can lead to system instability.

This vulnerability is rated as Moderate severity because exploitation leads to a denial of service (system crash) via a null pointer dereference rather than code execution or privilege escalation. Triggering the issue depends on hardware platforms utilizing device-tree definitions with zero-delay values on network physical layer devices that omit delay tables. Consequently, standard enterprise environments operating typical ACPI systems or unaffected network controllers are not exposed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.