What’s Vulnerable › Vulnerabilities

CVE-2024-38623: fs/ntfs3: Use variable length array instead of fixed size

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-21 · updated 2026-08-04
• Weakness: CWE-129

Description

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Use variable length array instead of fixed size Should fix smatch warning: ntfs_set_label() error: __builtin_memcpy() 'uni->name' too small (20 vs 256)

Affected products

• Linux kernel: from 5.15 before 5.15.161; from 5.16 before 6.1.93; from 6.2 before 6.6.33; from 6.7 before 6.9.4 — fixed in 5.15.161, 6.1.93, 6.6.33, 6.9.4

How to fix

Upgrade to a fixed version: Linux kernel 5.15.161, 6.1.93, 6.6.33, 6.9.4. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/1997cdc3e727526aa5d84b32f7cbb3f56459b7ef
• https://git.kernel.org/stable/c/1fe1c9dc21ee52920629d2d9b9bd84358931a8d1
• https://git.kernel.org/stable/c/3839a9b19a4b70eff6b6ad70446f639f7fd5a3d7
• https://git.kernel.org/stable/c/a2de301d90b782ac5d7a5fe32995caaee9ab3a0f
• https://git.kernel.org/stable/c/cceef44b34819c24bb6ed70dce5b524bd3e368d1
• https://git.kernel.org/stable/c/1997cdc3e727526aa5d84b32f7cbb3f56459b7ef
• https://git.kernel.org/stable/c/1fe1c9dc21ee52920629d2d9b9bd84358931a8d1
• https://git.kernel.org/stable/c/3839a9b19a4b70eff6b6ad70446f639f7fd5a3d7
• https://git.kernel.org/stable/c/a2de301d90b782ac5d7a5fe32995caaee9ab3a0f
• https://git.kernel.org/stable/c/cceef44b34819c24bb6ed70dce5b524bd3e368d1

Get alerted when CVE-2024-38623 or the next vulnerability affects your stack