iio: light: veml6030: fix IIO device retrieval from embedded device
The dev pointer that is received as an argument in the
in_illuminance_period_available_show function references the device
embedded in the IIO device, not in the i2c client.
dev_to_iio_dev() must be used to accessthe right data. The current
implementation leads to a segmentation fault on every attempt to read
the attribute because indio_dev gets a NULL assignment.
This bug has been present since the first appearance of the driver,
apparently since the last version (V6) before getting applied. A
constant attribute was used until then, and the last modifications might
have not been tested again.
Metrics
Affected Vendors & Products
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-4008-1 | linux-6.1 security update |
Debian DLA |
DLA-4075-1 | linux security update |
Ubuntu USN |
USN-7276-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7277-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7288-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7288-2 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7289-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7289-2 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7289-3 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7289-4 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7291-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7305-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7308-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7310-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7331-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7383-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7383-2 | Linux kernel (Real-time) vulnerabilities |
Ubuntu USN |
USN-7384-1 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-7384-2 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-7385-1 | Linux kernel (IBM) vulnerabilities |
Ubuntu USN |
USN-7386-1 | Linux kernel (OEM) vulnerabilities |
Ubuntu USN |
USN-7388-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7389-1 | Linux kernel (NVIDIA Tegra) vulnerabilities |
Ubuntu USN |
USN-7390-1 | Linux kernel (Xilinx ZynqMP) vulnerabilities |
Ubuntu USN |
USN-7403-1 | Linux kernel (HWE) vulnerabilities |
Ubuntu USN |
USN-7451-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7458-1 | Linux kernel (IBM) vulnerabilities |
Ubuntu USN |
USN-7468-1 | Linux kernel (Azure, N-Series) vulnerabilities |
Ubuntu USN |
USN-7523-1 | Linux kernel (Raspberry Pi Real-time) vulnerabilities |
Ubuntu USN |
USN-7524-1 | Linux kernel (Raspberry Pi) vulnerabilities |
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Mon, 03 Nov 2025 23:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Mon, 03 Nov 2025 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Wed, 01 Oct 2025 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Mon, 14 Jul 2025 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
epss
|
epss
|
Fri, 29 Nov 2024 21:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Linux
Linux linux Kernel |
|
| Weaknesses | CWE-476 | |
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:* |
|
| Vendors & Products |
Linux
Linux linux Kernel |
Fri, 22 Nov 2024 14:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
Fri, 08 Nov 2024 06:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: iio: light: veml6030: fix IIO device retrieval from embedded device The dev pointer that is received as an argument in the in_illuminance_period_available_show function references the device embedded in the IIO device, not in the i2c client. dev_to_iio_dev() must be used to accessthe right data. The current implementation leads to a segmentation fault on every attempt to read the attribute because indio_dev gets a NULL assignment. This bug has been present since the first appearance of the driver, apparently since the last version (V6) before getting applied. A constant attribute was used until then, and the last modifications might have not been tested again. | |
| Title | iio: light: veml6030: fix IIO device retrieval from embedded device | |
| References |
|
|
Status: PUBLISHED
Assigner: Linux
Published:
Updated: 2025-11-03T22:26:53.442Z
Reserved: 2024-10-21T19:36:19.969Z
Link: CVE-2024-50198
Updated: 2025-11-03T22:26:53.442Z
Status : Modified
Published: 2024-11-08T06:15:16.467
Modified: 2025-11-03T23:17:01.393
Link: CVE-2024-50198
OpenCVE Enrichment
No data.
Debian DLA
Ubuntu USN