What is CVE-2024-38554?

CVE-2024-38554 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10. CVE-2024-38554 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2024-38554?

CVE-2024-38554 has a CVSS score of 5.5 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2024-38554?

No patch is currently available for CVE-2024-38554. Monitor the NIST NVD and your Linux distribution's security advisories for updates.

Is CVE-2024-38554 actively exploited?

CVE-2024-38554 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2024-38554

Medium

In the Linux kernel, the following vulnerability has been resolved: ax25: Fix reference count leak issue of net_device There is a reference count leak issue of the object "net_device" in ax25_dev_device_down(). When the ax25 device is shutting down, the ax25_dev_device_down() drops the reference count of net_device one or zero times depending on if we goto unlock_put or not, which will cause memory leak. In order to solve the above issue, decrease the reference count of net_device after dev->ax25_ptr is set to null.

Package Linux Kernel

Published 2024-06-19

Last modified 2024-11-21

CVSS version 3.1

Patch available

Awaiting data

CVSS 3.1 score

5.5

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

The following references provide additional information about CVE-2024-38554 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.

Kernel patch commit
https://git.kernel.org/stable/c/36e56b1b002bb26440403053f19f9e1a8bc075b2
Patch
Kernel patch commit
https://git.kernel.org/stable/c/3ec437f9bbae68e9b38115c4c91de995f73f6bad
Patch
Kernel patch commit
https://git.kernel.org/stable/c/8bad3a20a27be8d935f2aae08d3c6e743754944a
Patch

5 patch commits total View all on NVD

Details

CVE ID CVE-2024-38554

Severity Medium

CVSS score 5.5 / 10

CVSS version 3.1

Published 2024-06-19

Modified 2024-11-21

KEV No

Patch Awaiting data

Package linux

Frequently asked questions

What is CVE-2024-38554?

CVE-2024-38554 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 . CVE-2024-38554 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2024-38554?

CVE-2024-38554 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2024-38554?

No patch is currently available for CVE-2024-38554. Monitor the NIST NVD and your Linux distribution's security advisories for updates.
Is CVE-2024-38554 actively exploited?

No — CVE-2024-38554 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.