⚠ Actively exploited
Added to CISA KEV on 2025-04-09. Federal agencies required to patch by 2025-04-30. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable..

CVE-2024-53150Out-of-bounds Read in Linux

CWE-125Out-of-bounds Read100 documents12 sources
Severity
7.1HIGHNVD
OSV8.8OSV7.8OSV5.5
EPSS
1.1%
top 21.75%
CISA KEV
KEV
Added 2025-04-09
Due 2025-04-30
Exploit
No known exploits
Timeline
PublishedDec 24
KEV addedApr 9
KEV dueApr 30
Latest updateDec 16
CISA Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HExploitability: 1.8 | Impact: 5.2

Affected Packages11 packages

Also affects: Debian Linux 11.0

Patches

🔴Vulnerability Details

48
OSV
linux-azure-fips vulnerabilities2025-12-16
OSV
linux-oracle vulnerabilities2025-11-19
OSV
linux-fips vulnerabilities2025-11-10
OSV
linux-azure, linux-azure-4.15 vulnerabilities2025-11-07
OSV
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities2025-11-06

📋Vendor Advisories

50
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities2025-12-16
Ubuntu
Linux kernel (Oracle) vulnerabilities2025-11-19
Ubuntu
Kernel Live Patch Security Notice2025-11-17
Ubuntu
Linux kernel (FIPS) vulnerabilities2025-11-10
Ubuntu
Linux kernel (Azure) vulnerabilities2025-11-07

🕵️Threat Intelligence

1
Bleepingcomputer
Google fixes Android zero-days exploited in attacks, 60 other flaws2025-04-07
CVE-2024-53150 — Out-of-bounds Read in Linux | cvebase