CVE-2024-58020

In the Linux kernel, the following vulnerability has been resolved:

HID: multitouch: Add NULL check in mt_input_configured

devm_kasprintf() can return a NULL pointer on failure,but this returned value in mt_input_configured() is not checked. Add NULL check in mt_input_configured(), to handle kernel NULL pointer dereference error.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires local access to attach or emulate a multitouch device under memory exhaustion conditions, resulting solely in a denial of service (system crash) rather than code execution or privilege escalation. The flaw resides in the kernel multitouch human interface driver during input configuration, where an unhandled memory allocation failure triggers a null pointer exception. Enterprise server environments typically do not utilize multitouch hardware, which significantly minimizes real-world exposure for standard deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.