Riskcovery

CVE-2024-36880

Bluetooth: qca: add missing firmware sanity checks

State
Published
Severity
7.8 High
Published
May 30, 2024
Updated
Aug 5, 2026
Reserved
May 30, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: qca: add missing firmware sanity checks

Add the missing sanity checks when parsing the firmware files before downloading them to avoid accessing and corrupting memory beyond the vmalloced buffer.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 83e81961ff7ef75f97756f316caea5aa6bcc19cc to before ed53949cc92e28aaa3463d246942bda1fbb7f307Affected
  • 83e81961ff7ef75f97756f316caea5aa6bcc19cc to before 1caceadfb50432dbf6d808796cb6c34ebb6d662cAffected
  • 83e81961ff7ef75f97756f316caea5aa6bcc19cc to before 427281f9498ed614f9aabc80e46ec077c487da6dAffected
  • 83e81961ff7ef75f97756f316caea5aa6bcc19cc to before 02f05ed44b71152d5e11d29be28aed91c0489b4eAffected
  • 83e81961ff7ef75f97756f316caea5aa6bcc19cc to before 2e4edfa1e2bd821a317e7d006517dcf2f3fac68dAffected
LinuxLinux
  • 4.3Affected
  • before 4.3Not affected
  • 5.15.159 through 5.15.*Not affected
  • 6.1.91 through 6.1.*Not affected
  • 6.6.31 through 6.6.*Not affected
  • 6.8.10 through 6.8.*Not affected
  • 6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.