{"id":"DEBIAN-CVE-2024-36930","details":"In the Linux kernel, the following vulnerability has been resolved:  spi: fix null pointer dereference within spi_sync  If spi_sync() is called with the non-empty queue and the same spi_message is then reused, the complete callback for the message remains set while the context is cleared, leading to a null pointer dereference when the callback is invoked from spi_finalize_current_message().  With function inlining disabled, the call stack might look like this:    _raw_spin_lock_irqsave from complete_with_flags+0x18/0x58   complete_with_flags from spi_complete+0x8/0xc   spi_complete from spi_finalize_current_message+0xec/0x184   spi_finalize_current_message from spi_transfer_one_message+0x2a8/0x474   spi_transfer_one_message from __spi_pump_transfer_message+0x104/0x230   __spi_pump_transfer_message from __spi_transfer_message_noqueue+0x30/0xc4   __spi_transfer_message_noqueue from __spi_sync+0x204/0x248   __spi_sync from spi_sync+0x24/0x3c   spi_sync from mcp251xfd_regmap_crc_read+0x124/0x28c [mcp251xfd]   mcp251xfd_regmap_crc_read [mcp251xfd] from _regmap_raw_read+0xf8/0x154   _regmap_raw_read from _regmap_bus_read+0x44/0x70   _regmap_bus_read from _regmap_read+0x60/0xd8   _regmap_read from regmap_read+0x3c/0x5c   regmap_read from mcp251xfd_alloc_can_err_skb+0x1c/0x54 [mcp251xfd]   mcp251xfd_alloc_can_err_skb [mcp251xfd] from mcp251xfd_irq+0x194/0xe70 [mcp251xfd]   mcp251xfd_irq [mcp251xfd] from irq_thread_fn+0x1c/0x78   irq_thread_fn from irq_thread+0x118/0x1f4   irq_thread from kthread+0xd8/0xf4   kthread from ret_from_fork+0x14/0x28  Fix this by also setting message-\u003ecomplete to NULL when the transfer is complete.","modified":"2026-09-15T09:03:12.695460940Z","published":"2024-05-30T16:15:16.217Z","upstream":["CVE-2024-36930"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-36930"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.94-1"}]}],"versions":["6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1~bpo11+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-36930.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.11-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-36930.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.11-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-36930.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}