CVE-2024-35994

A vulnerability was found in the Qualcomm firmware driver (qcom_qseecom_uefisecapp) in the Linux kernel. It arises from incorrect memory allocation for request and response buffers in the QSEECOM APP_SEND command. The driver expects both buffers to be in a single memory region, but they are allocated separately, leading to potential issues such as no response being written (EIO error), failure of the SCM call (EINVAL), or device hard-reset. The issue is fixed by allocating a single memory region for both buffers, with DMA allocation responsibilities moved to the caller.

Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.