⚠ Actively exploited
Added to CISA KEV on 2025-04-09. Federal agencies required to patch by 2025-04-30. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable..
CVE-2024-53197 — Out-of-bounds Write in Linux
Severity
7.8HIGHNVD
OSV8.8OSV5.5
EPSS
1.8%
top 17.31%
CISA KEV
KEV
Added 2025-04-09
Due 2025-04-30
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedDec 27
KEV addedApr 9
KEV dueApr 30
Latest updateJan 29
CISA Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
A bogus device can provide a bNumConfigurations value that exceeds the
initial value used in usb_get_configuration for allocating dev->config.
This can lead to out-of-bounds accesses later, e.g. in
usb_destroy_configuration.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages7 packages
▶CVEListV5linux/linux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 — 0b4ea4bfe16566b84645ded1403756a2dc4e0f19+9
Also affects: Debian Linux 11.0
Patches
🔴Vulnerability Details
45OSV▶
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle vulnerabilities↗2025-07-08