CVE-2024-26927

HIGH

Linux kernel - Memory Corruption

Title source: llm

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Add some bounds checking to firmware data Smatch complains about "head->full_size - head->header_size" can underflow. To some extent, we're always going to have to trust the firmware a bit. However, it's easy enough to add a check for negatives, and let's add a upper bounds check as well.

Scores

CVSS v3 8.4
EPSS 0.0006
EPSS Percentile 19.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-120
Status published

Affected Products (5)

linux/linux_kernel < 6.1.83
linux/Kernel < 6.1.83linux
linux/Kernel < 6.6.23linux
linux/Kernel < 6.7.11linux
linux/Kernel < 6.8.2linux

Timeline

Published Apr 28, 2024
Tracked Since Feb 18, 2026