CVE-2024-50058serial: protect uart_port_dtr_rts() in uart_shutdown() too
- 5.5MediumCVSS base score
- 0.25%Exploitation in 30 daysEPSS · top 84% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: serial: protect uart_port_dtr_rts() in uart_shutdown() too Commit af224ca2df29 (serial: core: Prevent unsafe uart port access, part 3) added few uport == NULL checks. It added one to uart_shutdown(), so the commit assumes, uport can be NULL in there. But right after that protection, there is an unprotected "uart_port_dtr_rts(uport, false);" call. That is invoked only if HUPCL is set, so I assume that is the reason why we do not see lots of these reports. Or it cannot be NULL at this point at all for some reason :P. Until the above is investigated, stay on the safe side and move this dereference to the if too. I got this inconsistency from Coverity under CID 1585130. Thanks.
Timeline
ID reserved
By Linux
Published
- 24 months later
· 24 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.25% · top 84% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected af224ca2df297440448b9d407d21b50982c6d532 – < 2fe399bb8efd0d325ab1138cf8e3ecf23a39e96d
- affected af224ca2df297440448b9d407d21b50982c6d532 – < 399927f0f875b93f3d5a0336d382ba48b8671eb2
- affected af224ca2df297440448b9d407d21b50982c6d532 – < d7b5876a6e74cdf8468a478be6b23f2f5464ac7a
- affected af224ca2df297440448b9d407d21b50982c6d532 – < e418d91195d29d5f9c9685ff309b92b04b41dc40
- affected af224ca2df297440448b9d407d21b50982c6d532 – < 76ed24a34223bb2c6b6162e1d8389ec4e602a290
- affected af224ca2df297440448b9d407d21b50982c6d532 – < 602babaa84d627923713acaf5f7e9a4369e77473
- affected 4.7
- unaffected < 4.7
- unaffected 5.10.229 – ≤ 5.10.*
- unaffected 5.15.170 – ≤ 5.15.*
- unaffected 6.1.115 – ≤ 6.1.*
- unaffected 6.6.57 – ≤ 6.6.*
- unaffected 6.11.4 – ≤ 6.11.*
- unaffected 6.12 – ≤ *
References
References9
- https://git.kernel.org/stable/c/2fe399bb8efd0d325ab1138cf8e3ecf23a39e96d (opens in a new tab)
- https://git.kernel.org/stable/c/399927f0f875b93f3d5a0336d382ba48b8671eb2 (opens in a new tab)
- https://git.kernel.org/stable/c/d7b5876a6e74cdf8468a478be6b23f2f5464ac7a (opens in a new tab)
- https://git.kernel.org/stable/c/e418d91195d29d5f9c9685ff309b92b04b41dc40 (opens in a new tab)
- https://git.kernel.org/stable/c/76ed24a34223bb2c6b6162e1d8389ec4e602a290 (opens in a new tab)
- https://git.kernel.org/stable/c/602babaa84d627923713acaf5f7e9a4369e77473 (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-44760 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-50058)Record last updated .