5.5

CVE-2024-50058: linux NULL Pointer Dereference

CVSS: 5.5v3.1MediumModified
AliasesUBUNTU-CVE-2024-50058DEBIAN-CVE-2024-50058
Published 21-10-2024Last modified 15-10-2026
Open JSON

Vulnerability summary

CVE-2024-50058 is a medium (CVSS 5.5) NULL Pointer Dereference vulnerability in linux. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.7% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.24%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 46 · Related 43
DLA-4008-1DLA-4075-1MGASA-2024-0344MGASA-2024-0345OPENSUSE-SU-2024:14500-1OPENSUSE-SU-2025:14705-1

Timeline

  1. 21-10-2024
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: serial: protect uart_port_dtr_rts() in uart_shutdown() too Commit af224ca2df29 (serial: core: Prevent unsafe uart port access, part 3) added few uport == NULL checks. It added one to uart_shutdown(), so the commit assumes, uport can be NULL in there. But right after that protection, there is an unprotected "uart_port_dtr_rts(uport, false);" call. That is invoked only if HUPCL is set, so I assume that is the reason why we do not see lots of these reports. Or it cannot be NULL at this point at all for some reason :P. Until the above is investigated, stay on the safe side and move this dereference to the if too. I got this inconsistency from Coverity under CID 1585130. Thanks.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.24%

Chance of exploitation in the next 30 days

Percentile

15%

Versus all other CVEs

30-day change

0.00 pp

From 0.24% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.24%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu135 products
  • linuxAll versions (No fix recorded) | < 5.15.0-133.144 | < 6.8.0-56.58
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1078.85 | < 6.8.0-1025.27
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ af224ca2df297440448b9d407d21b50982c6d532, < 2fe399bb8efd0d325ab1138cf8e3ecf23a39e96d | ≥ af224ca2df297440448b9d407d21b50982c6d532, < 399927f0f875b93f3d5a0336d382ba48b8671eb2 | ≥ af224ca2df297440448b9d407d21b50982c6d532, < d7b5876a6e74cdf8468a478be6b23f2f5464ac7a | ≥ af224ca2df297440448b9d407d21b50982c6d532, < e418d91195d29d5f9c9685ff309b92b04b41dc40 | ≥ af224ca2df297440448b9d407d21b50982c6d532, < 76ed24a34223bb2c6b6162e1d8389ec4e602a290 | ≥ af224ca2df297440448b9d407d21b50982c6d532, < 602babaa84d627923713acaf5f7e9a4369e77473 | 4.7
  • linux_kernel< 6.6.57 | ≥ 6.7, < 6.11.4
Debian1 product
  • linux< 6.1.115-1 | < 6.11.4-1

3 vendors · 138 products

References

42 links
Show all 42 references