⚠ Actively exploited
Added to CISA KEV on 2025-04-09. Federal agencies required to patch by 2025-04-30. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable..
CVE-2024-53150 — Out-of-bounds Read in Linux
Severity
7.1HIGHNVD
OSV8.8OSV7.8OSV5.5
EPSS
1.1%
top 21.75%
CISA KEV
KEV
Added 2025-04-09
Due 2025-04-30
Exploit
No known exploits
Affected products
Timeline
PublishedDec 24
KEV addedApr 9
KEV dueApr 30
Latest updateDec 16
CISA Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
The current USB-audio driver code doesn't check bLength of each
descriptor at traversing for clock descriptors. That is, when a
device provides a bogus descriptor with a shorter bLength, the driver
might hit out-of-bounds reads.
For addressing it, this patch adds sanity checks to the validator
functions for the clock descriptor traversal. When the descriptor
…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HExploitability: 1.8 | Impact: 5.2
Affected Packages11 packages
Also affects: Debian Linux 11.0