What’s Vulnerable › Vulnerabilities

CVE-2024-27025: nbd: null check for nla_nest_start

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-01 · updated 2026-10-15
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: nbd: null check for nla_nest_start nla_nest_start() may fail and return NULL. Insert a check and set errno based on other call sites within the same source code.

Affected products

• Debian Linux: 10.0
• Linux kernel: from 4.12 before 5.4.273; from 5.5 before 5.10.214; from 5.11 before 5.15.153; from 5.16 before 6.1.83; from 6.2 before 6.6.23; from 6.7 before 6.7.11 — fixed in 5.10.214, 5.15.153, 5.4.273, 6.1.83, 6.6.23, 6.7.11

How to fix

Upgrade to a fixed version: Linux kernel 5.10.214, 5.15.153, 5.4.273, 6.1.83. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/31edf4bbe0ba27fd03ac7d87eb2ee3d2a231af6d
• https://git.kernel.org/stable/c/44214d744be32a4769faebba764510888f1eb19e
• https://git.kernel.org/stable/c/4af837db0fd3679fabc7b7758397090b0c06dced
• https://git.kernel.org/stable/c/96436365e5d80d0106ea785a4f80a58e7c9edff8
• https://git.kernel.org/stable/c/98e60b538e66c90b9a856828c71d4e975ebfa797
• https://git.kernel.org/stable/c/b7f5aed55829f376e4f7e5ea5b80ccdcb023e983
• https://git.kernel.org/stable/c/ba6a9970ce9e284cbc04099361c58731e308596a
• https://git.kernel.org/stable/c/e803040b368d046434fbc8a91945c690332c4fcf
• https://git.kernel.org/stable/c/31edf4bbe0ba27fd03ac7d87eb2ee3d2a231af6d
• https://git.kernel.org/stable/c/44214d744be32a4769faebba764510888f1eb19e
• https://git.kernel.org/stable/c/4af837db0fd3679fabc7b7758397090b0c06dced
• https://git.kernel.org/stable/c/96436365e5d80d0106ea785a4f80a58e7c9edff8

Get alerted when CVE-2024-27025 or the next vulnerability affects your stack