CVE-2024-36015: ppdev: Add an error check in register_device

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-29 · updated 2026-06-17
Weakness: CWE-129

Description

In the Linux kernel, the following vulnerability has been resolved: ppdev: Add an error check in register_device In register_device, the return value of ida_simple_get is unchecked, in witch ida_simple_get will use an invalid index value. To address this issue, index should be checked after ida_simple_get. When the index value is abnormal, a warning message should be printed, the port should be dropped, and the value should be recorded.

Affected products

Linux kernel: from 4.9.22 before 4.10; from 4.10.7 before 4.11; from 4.11.1 before 4.19.316; from 4.20 before 5.4.278; from 5.5 before 5.10.219; from 5.11 before 5.15.161 — fixed in 4.10, 4.11, 4.19.316, 5.10.219, 5.15.161, 5.4.278

How to fix

Upgrade to a fixed version: Linux kernel 4.10, 4.11, 4.19.316, 5.10.219. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-36015 or the next vulnerability affects your stack