CVE-2024-46859

HighCVSS 7.8/10Last modified Aug 4, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses

The panasonic laptop code in various places uses the SINF array with index values of 0 - SINF_CUR_BRIGHT(0x0d) without checking that the SINF array is big enough.

Not all panasonic laptops have this many SINF array entries, for example the Toughbook CF-18 model only has 10 SINF array entries. So it only supports the AC+DC brightness entries and mute.

Check that the SINF array has a minimum size which covers all AC+DC brightness entries and refuse to load if the SINF array is smaller.

For higher SINF indexes hide the sysfs attributes when the SINF array does not contain an entry for that attribute, avoiding show()/store() accessing the array out of bounds and add bounds checking to the probe() and resume() code accessing these.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

VendorProductVersions
LinuxLinux>= e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6, < b7c2f692307fe704be87ea80d7328782b33c3cef; >= e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6, < 9291fadbd2720a869b1d2fcf82305648e2e62a16; >= e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6, < 6821a82616f60aa72c5909b3e252ad97fb9f7e2a; >= e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6, < b38c19783286a71693c2194ed1b36665168c09c4; >= e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6, < f52e98d16e9bd7dd2b3aef8e38db5cbc9899d6a4
LinuxLinux3.3

References

Timeline

Published
Sep 27, 2024
Last modified
Aug 4, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-46866.1A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as problematic. This issue affectsCVE-2024-468605.5In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change CVE-2024-468615.5In the Linux kernel, the following vulnerability has been resolved: usbnet: ipheth: do not stop RX on failing RX callback RX callbacks canCVE-2024-468625.5In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: soc-acpi-intel-mtl-match: add missing empty item There isCVE-2024-468635.5In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: soc-acpi-intel-lnl-match: add missing empty item There isCVE-2024-468645.5In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: fix kexec crash due to VP assist page corruption commit 96CVE-2024-468657.1In the Linux kernel, the following vulnerability has been resolved: fou: fix initialization of grc The grc must be initialize first. ThereCVE-2024-468665.5In the Linux kernel, the following vulnerability has been resolved: drm/xe/client: add missing bo locking in show_meminfo() bo_meminfo() wCVE-2024-468675.5In the Linux kernel, the following vulnerability has been resolved: drm/xe/client: fix deadlock in show_meminfo() There is a real deadlockCVE-2024-468685.5In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: uefisecapp: Fix deadlock in qcuefi_acquire() If the __CVE-2024-468695.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: Allocate memory for driver private data Fix dCVE-2024-46876.1A vulnerability classified as problematic has been found in Campcodes Complete Web-Based School Management System 1.0. Affected is an unknow
CVE-2024-46859: High severity, CVSS 7.8 | Vulnix