What’s Vulnerable › Vulnerabilities

CVE-2024-36898: gpiolib: cdev: fix uninitialised kfifo

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-30 · updated 2026-08-04
• Weakness: CWE-908

Description

In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: fix uninitialised kfifo If a line is requested with debounce, and that results in debouncing in software, and the line is subsequently reconfigured to enable edge detection then the allocation of the kfifo to contain edge events is overlooked. This results in events being written to and read from an uninitialised kfifo. Read events are returned to userspace. Initialise the kfifo in the case where the software debounce is already active.

Affected products

• Linux kernel: from 5.10 before 5.15.203; from 5.16 before 6.1.91; from 6.2 before 6.6.31; from 6.7 before 6.8.10; 6.9-rc1, 6.9-rc2, 6.9-rc3, 6.9-rc4, 6.9-rc5, 6.9-rc6 (+1) — fixed in 5.15.203, 6.1.91, 6.6.31, 6.8.10

How to fix

Upgrade to a fixed version: Linux kernel 5.15.203, 6.1.91, 6.6.31, 6.8.10. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/1a51e24404d77bb3307c1e39eee0d8e86febb1a5
• https://git.kernel.org/stable/c/883e4bbf06eb5fb7482679e4edb201093e9f55a2
• https://git.kernel.org/stable/c/bd7139a70ee8d8ea872b223e043730cf6f5e2b0e
• https://git.kernel.org/stable/c/c87cc32bc48b187067e089b15ab7a6a7eed5767d
• https://git.kernel.org/stable/c/ee0166b637a5e376118e9659e5b4148080f1d27e
• https://git.kernel.org/stable/c/1a51e24404d77bb3307c1e39eee0d8e86febb1a5
• https://git.kernel.org/stable/c/883e4bbf06eb5fb7482679e4edb201093e9f55a2
• https://git.kernel.org/stable/c/bd7139a70ee8d8ea872b223e043730cf6f5e2b0e
• https://git.kernel.org/stable/c/ee0166b637a5e376118e9659e5b4148080f1d27e

Get alerted when CVE-2024-36898 or the next vulnerability affects your stack