CVE-2024-42276: nvme-pci: add missing condition check for existence of mapped data
In the Linux kernel, the following vulnerability has been resolved:
nvme-pci: add missing condition check for existence of mapped data
nvmemapdata() is called when request has physical segments, hence the nvmeunmapdata() should have same condition to avoid dereference.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42276?
CVE-2024-42276 is classified with high severity due to potential data corruption issues in the Linux kernel.
How do I fix CVE-2024-42276?
To remediate CVE-2024-42276, update the Linux kernel to the fixed versions: 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
Which Linux kernel versions are affected by CVE-2024-42276?
CVE-2024-42276 affects Linux kernel versions up to and including 5.10.223-1.
What does CVE-2024-42276 impact?
CVE-2024-42276 impacts the nvme-pci driver in the Linux kernel, specifically related to mapped data handling.
Is CVE-2024-42276 applicable only to Debian Linux?
While CVE-2024-42276 is currently referenced in the context of Debian, similar vulnerabilities may be present in other distributions using affected kernel versions.