In the Linux kernel, the following vulnerability has been resolved: net: mediatek: Fix potential NULL pointer dereference in dummy net_device… (CVE-2024-42282)
A potential NULL pointer dereference vulnerability in the Linux kernel's MediaTek network driver was fixed by moving the freeing of a dummy network device to a safer point in the code. This prevents a NULL pointer dereference that could occur if allocation of the dummy device failed during device probing.
AI Analysis
Technical Summary
The vulnerability (CVE-2024-42282) in the Linux kernel's MediaTek network driver involved a potential NULL pointer dereference in dummy net_device handling. Specifically, if alloc_netdev_dummy() failed during mtk_probe(), the dummy_dev pointer would be NULL. The error path would then call mtk_free_dev(), which called free_netdev() assuming dummy_dev was allocated, causing a NULL pointer dereference. The fix moves free_netdev() from mtk_free_dev() to mtk_remove(), ensuring it is only called when dummy_dev is fully allocated, thereby preventing the NULL pointer dereference.
Potential Impact
This vulnerability can cause a NULL pointer dereference leading to a denial of service (kernel crash) but does not impact confidentiality or integrity. The CVSS score is 5.5 (medium severity) with local attack vector, low complexity, low privileges required, no user interaction, and impact limited to availability.
Mitigation Recommendations
A fix is available and has been applied in the Linux kernel by relocating the free_netdev() call to mtk_remove(). Users should update to the fixed kernel version that includes this patch to remediate the vulnerability.
In the Linux kernel, the following vulnerability has been resolved: net: mediatek: Fix potential NULL pointer dereference in dummy net_device… (CVE-2024-42282)
Description
A potential NULL pointer dereference vulnerability in the Linux kernel's MediaTek network driver was fixed by moving the freeing of a dummy network device to a safer point in the code. This prevents a NULL pointer dereference that could occur if allocation of the dummy device failed during device probing.
CVSS v3.1
Score 5.5medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability (CVE-2024-42282) in the Linux kernel's MediaTek network driver involved a potential NULL pointer dereference in dummy net_device handling. Specifically, if alloc_netdev_dummy() failed during mtk_probe(), the dummy_dev pointer would be NULL. The error path would then call mtk_free_dev(), which called free_netdev() assuming dummy_dev was allocated, causing a NULL pointer dereference. The fix moves free_netdev() from mtk_free_dev() to mtk_remove(), ensuring it is only called when dummy_dev is fully allocated, thereby preventing the NULL pointer dereference.
Potential Impact
This vulnerability can cause a NULL pointer dereference leading to a denial of service (kernel crash) but does not impact confidentiality or integrity. The CVSS score is 5.5 (medium severity) with local attack vector, low complexity, low privileges required, no user interaction, and impact limited to availability.
Mitigation Recommendations
A fix is available and has been applied in the Linux kernel by relocating the free_netdev() call to mtk_remove(). Users should update to the fixed kernel version that includes this patch to remediate the vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-mhhw-j772-75h5
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2024-42282"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6ac13969a43b0b3b89d5fbb2
Added to database: 10/03/2026, 17:20:41 UTC
Last enriched: 10/03/2026, 17:23:59 UTC
Last updated: 10/04/2026, 02:45:59 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.