Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
  • Support the projectPage
Back

CVE-2024-43883

usb: vhci-hcd: Do not drop references before new references are gained

Description

In the Linux kernel, the following vulnerability has been resolved: usb: vhci-hcd: Do not drop references before new references are gained At a few places the driver carries stale pointers to references that can still be used. Make sure that does not happen. This strictly speaking closes ZDI-CAN-22273, though there may be similar races in the driver.

Timeline

  1. ID reserved

    By Linux

  2. · 6 days later

    Published

  3. · 24 months later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2024-43883, by who scored it
Scored byCVSSScoreVector
LinuxCNA (assigner)3.1Critical9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Modified3.1High7.0CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
0.65% · top 49% of all CVEs (10 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Affected products

  • Linux · Linux

    • affected 7606ee8aa33287dd3e6eb44c78541b87a413a325 – < 5a3c473b28ae1c1f7c4dc129e30cb19ae6e96f89
    • affected 7606ee8aa33287dd3e6eb44c78541b87a413a325 – < 9c3746ce8d8fcb3a2405644fc0eec7fc5312de80
    • affected 7606ee8aa33287dd3e6eb44c78541b87a413a325 – < 4dacdb9720aaab10b6be121eae55820174d97174
    • affected 7606ee8aa33287dd3e6eb44c78541b87a413a325 – < e8c1e606dab8c56cf074b43b98d0805de7322ba2
    • affected 7606ee8aa33287dd3e6eb44c78541b87a413a325 – < 585e6bc7d0a9bf73a8be3d3fb34e86b90cc61a14
    • affected 7606ee8aa33287dd3e6eb44c78541b87a413a325 – < 128e82e41cf7d74a562726c1587d9d2ede1a0a37
    • affected 7606ee8aa33287dd3e6eb44c78541b87a413a325 – < c3d0857b7fc2c49f68f89128a5440176089a8f54
    • affected 7606ee8aa33287dd3e6eb44c78541b87a413a325 – < afdcfd3d6fcdeca2735ca8d994c5f2d24a368f0a
    • affected 96ea4801d2035f89fc4ec4a67f49a18c35cb6715
    • affected 075b4e6a982d38121250c090f7b9294314ac1b19
    • affected 436e52f1a628233f080605dd736594df250897ca
    • affected 1c8d316294916da7e2a2f1f178ca3f3bd6d7b531
    • affected 927c3fa44e24300eb827ab9f9dacce6dff9c9bb7
    • affected 2.6.32.30 – < 2.6.33
    • affected 2.6.33.8 – < 2.6.34
    • affected 2.6.34.10 – < 2.6.35
    • affected 2.6.35.12 – < 2.6.36
    • affected 2.6.37.3 – < 2.6.38

  • Linux · Linux

    • affected 2.6.38
    • unaffected < 2.6.38
    • unaffected 4.19.320 – ≤ 4.19.*
    • unaffected 5.4.282 – ≤ 5.4.*
    • unaffected 5.10.224 – ≤ 5.10.*
    • unaffected 5.15.165 – ≤ 5.15.*
    • unaffected 6.1.105 – ≤ 6.1.*
    • unaffected 6.6.46 – ≤ 6.6.*
    • unaffected 6.10.5 – ≤ 6.10.*
    • unaffected 6.11 – ≤ *

References

10

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2024-43883 badge
[![CVE-2024-43883](https://cveledger.app/badge/CVE-2024-43883.svg)](https://cveledger.app/cve/CVE-2024-43883)

Record last updated .