CVE-2024-39482bcache: fix variable length array abuse in btree_iter
Updated under an hour ago ()
Does this affect you?
It affects Linux and 5 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bcache: fix variable length array abuse in btree_iter btree_iter is used in two ways: either allocated on the stack with a fixed size MAX_BSETS, or from a mempool with a dynamic size based on the specific cache set. Previously, the struct had a fixed-length array of size MAX_BSETS which was indexed out-of-bounds for the dynamically-sized iterators, which causes UBSAN to complain. This patch uses the same approach as in bcachefs's sort_iter and splits the iterator into a btree_iter with a flexible array member and a btree_iter_stack which embeds a btree_iter as well as a fixed-length data array.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from cafe563591446cf80bfbc2fe3bc72a2e36cf1060 before 2c3d7b03b658dc8bfa6112b194b67b92a87e081b; from cafe563591446cf80bfbc2fe3bc72a2e36cf1060 before 5a1922adc5798b7ec894cd3f197afb6f9591b023; from cafe563591446cf80bfbc2fe3bc72a2e36cf1060 before 934e1e4331859183a861f396d7dfaf33cb5afb02; from cafe563591446cf80bfbc2fe3bc72a2e36cf1060 before 6479b9f41583b013041943c4602e1ad61cec8148; from cafe563591446cf80bfbc2fe3bc72a2e36cf1060 before 0c31344e22dd8d6b1394c6e4c41d639015bdc671; from cafe563591446cf80bfbc2fe3bc72a2e36cf1060 before 3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31 | CNA record |
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name) | before V3.1 | CISA ADP |
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family siemens:scalance_xc_300_xr_300_xc_400_xr_500wg_xr_500_family (from the name) | all versions not affected | CISA ADP |
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family siemens:scalance_xcm_xrm_xch_xrh_300_family (from the name) | before V3.1 | CISA ADP |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | before V1.1.1 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 5.10 before 5.10.221; from 5.15 before 5.15.162; from 6.1 before 6.1.94; from 6.6 before 6.6.34; from 6.9 before 6.9.5 | NVD |
References
- https://git.kernel.org/stable/c/2c3d7b03b658dc8bfa6112b194b67b92a87e081bmailing-list, patch
- https://git.kernel.org/stable/c/5a1922adc5798b7ec894cd3f197afb6f9591b023mailing-list, patch
- https://git.kernel.org/stable/c/934e1e4331859183a861f396d7dfaf33cb5afb02mailing-list, patch
- https://git.kernel.org/stable/c/6479b9f41583b013041943c4602e1ad61cec8148mailing-list, patch
- https://git.kernel.org/stable/c/0c31344e22dd8d6b1394c6e4c41d639015bdc671mailing-list, patch
- https://git.kernel.org/stable/c/3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31mailing-list, patch
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-355557.html
- https://cert-portal.siemens.com/productcert/html/ssa-613116.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.