CVE-2024-35848

CVE-2024-35848 is a vulnerability in the Linux kernel's EEPROM driver (at24) that can lead to memory corruption. The issue arises when an EEPROM device is inaccessible: the system registers an nvmem device, the read operation fails, and the device is subsequently torn down. If another driver attempts to access the nvmem device after this teardown, it may reference invalid memory, causing potential system instability. The problem has been resolved by adjusting the failure handling to occur before the nvmem device is registered, preventing access to invalid memory. Users should update their Linux kernel to a version that includes this fix to ensure system reliability.

Moderate severity is assigned to this flaw because exploitation requires local access and is constrained to systems configured with specific I2C EEPROM hardware, limiting the practical risk to a denial of service. Standard enterprise installations rarely utilize or expose these devices, significantly reducing exposure across typical deployments. Furthermore, triggering the condition requires concurrent driver access while an EEPROM device fails and undergoes teardown, making deliberate exploitation difficult.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.