CVE-2024-36898gpiolib: cdev: fix uninitialised kfifo
- 7.1HighCVSS base score
- 0.24%Exploitation in 30 daysEPSS · top 85% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: fix uninitialised kfifo If a line is requested with debounce, and that results in debouncing in software, and the line is subsequently reconfigured to enable edge detection then the allocation of the kfifo to contain edge events is overlooked. This results in events being written to and read from an uninitialised kfifo. Read events are returned to userspace. Initialise the kfifo in the case where the software debounce is already active.
Timeline
ID reserved
By Linux
Published
- 2 years later
· 2 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
| NVDNVD · Modified | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.24% · top 85% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.
Affected products
- affected 65cff70464068a823b3f4a28074000febdce0630 – < c87cc32bc48b187067e089b15ab7a6a7eed5767d
- affected 65cff70464068a823b3f4a28074000febdce0630 – < 1a51e24404d77bb3307c1e39eee0d8e86febb1a5
- affected 65cff70464068a823b3f4a28074000febdce0630 – < 883e4bbf06eb5fb7482679e4edb201093e9f55a2
- affected 65cff70464068a823b3f4a28074000febdce0630 – < bd7139a70ee8d8ea872b223e043730cf6f5e2b0e
- affected 65cff70464068a823b3f4a28074000febdce0630 – < ee0166b637a5e376118e9659e5b4148080f1d27e
- affected 5.10
- unaffected < 5.10
- unaffected 5.15.203 – ≤ 5.15.*
- unaffected 6.1.91 – ≤ 6.1.*
- unaffected 6.6.31 – ≤ 6.6.*
- unaffected 6.8.10 – ≤ 6.8.*
- unaffected 6.9 – ≤ *
References
References5
- https://git.kernel.org/stable/c/c87cc32bc48b187067e089b15ab7a6a7eed5767d (opens in a new tab)
- https://git.kernel.org/stable/c/1a51e24404d77bb3307c1e39eee0d8e86febb1a5 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/883e4bbf06eb5fb7482679e4edb201093e9f55a2 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/bd7139a70ee8d8ea872b223e043730cf6f5e2b0e (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/ee0166b637a5e376118e9659e5b4148080f1d27e (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-36250 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-36898)Record last updated .