CVE-2024-58080 is a vulnerability identified in the Linux kernel, specifically within the Qualcomm clock driver for the SM6350 chipset (dispcc-sm6350). The issue arises because the clk_rcg2 clock structure, when having a parent clock, lacks a defined parent_map property. The parent_map is essential for correctly mapping parent clocks to their respective indices. Without this mapping, the kernel encounters a NULL pointer dereference when the clk_set_rate function is invoked. This leads to a kernel crash or panic, as demonstrated by the call trace provided, which shows the failure occurring during the frequency determination and clock rate setting routines. The root cause is a missing parent_map property and the inlining of parent_data, which should be kept together with parent_map to maintain consistency. The fix involves adding the missing parent_map property and un-inlining the parent_data to ensure proper association. This vulnerability is a logic error in the clock framework of the Linux kernel and can cause denial of service (DoS) by crashing the kernel when certain clock rate changes are attempted. The affected versions are identified by specific commit hashes, indicating this is a recent and targeted fix. There are no known exploits in the wild at this time, and no CVSS score has been assigned yet.

For European organizations, the impact of CVE-2024-58080 primarily revolves around system stability and availability. Systems running Linux kernels with the affected Qualcomm SM6350 clock driver could experience kernel panics or crashes when the clock rate is set or changed, potentially leading to unexpected downtime. This is particularly relevant for embedded systems, mobile devices, or network equipment using this chipset and Linux kernel version. Critical infrastructure or industrial control systems relying on affected hardware could face operational disruptions. Although this vulnerability does not directly lead to privilege escalation or data leakage, the denial of service caused by kernel crashes can interrupt business operations, degrade service availability, and increase maintenance costs. Organizations with large Linux deployments, especially those using Qualcomm-based hardware, may need to prioritize patching to avoid service interruptions. Since no exploits are known in the wild, the immediate risk is moderate, but the potential for future exploitation to cause targeted DoS attacks exists.

To mitigate CVE-2024-58080, European organizations should: 1) Identify all systems running Linux kernels with Qualcomm SM6350 chipset support, particularly those using the dispcc-sm6350 clock driver. 2) Apply the official Linux kernel patches that add the missing parent_map property and correct the parent_data inlining as soon as they become available in stable kernel releases or backports. 3) For embedded or custom Linux distributions, coordinate with vendors or maintainers to integrate the fix promptly. 4) Implement monitoring for kernel panics or clock-related errors to detect potential exploitation attempts or system instability early. 5) Where possible, restrict access to systems that can trigger clock rate changes to trusted administrators to reduce accidental or malicious triggering of the vulnerability. 6) Test patches in staging environments before deployment to ensure compatibility and stability. 7) Maintain updated inventories of hardware and kernel versions to quickly assess exposure to this vulnerability in future audits.