CVE-2024-36898

gpiolib: cdev: fix uninitialised kfifo

State: Published
Severity: 7.1 High
Published: May 30, 2024
Updated: Aug 5, 2026
Reserved: May 30, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

gpiolib: cdev: fix uninitialised kfifo

If a line is requested with debounce, and that results in debouncing in software, and the line is subsequently reconfigured to enable edge detection then the allocation of the kfifo to contain edge events is overlooked. This results in events being written to and read from an uninitialised kfifo. Read events are returned to userspace.

Initialise the kfifo in the case where the software debounce is already active.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	65cff70464068a823b3f4a28074000febdce0630 to before c87cc32bc48b187067e089b15ab7a6a7eed5767dAffected 65cff70464068a823b3f4a28074000febdce0630 to before 1a51e24404d77bb3307c1e39eee0d8e86febb1a5Affected 65cff70464068a823b3f4a28074000febdce0630 to before 883e4bbf06eb5fb7482679e4edb201093e9f55a2Affected 65cff70464068a823b3f4a28074000febdce0630 to before bd7139a70ee8d8ea872b223e043730cf6f5e2b0eAffected 65cff70464068a823b3f4a28074000febdce0630 to before ee0166b637a5e376118e9659e5b4148080f1d27eAffected
LinuxLinux	5.10Affected before 5.10Not affected 5.15.203 through 5.15.Not affected 6.1.91 through 6.1.Not affected 6.6.31 through 6.6.Not affected 6.8.10 through 6.8.Not affected 6.9 and laterNot affected

Product

Versions

LinuxLinux

65cff70464068a823b3f4a28074000febdce0630 to before c87cc32bc48b187067e089b15ab7a6a7eed5767dAffected
65cff70464068a823b3f4a28074000febdce0630 to before 1a51e24404d77bb3307c1e39eee0d8e86febb1a5Affected
65cff70464068a823b3f4a28074000febdce0630 to before 883e4bbf06eb5fb7482679e4edb201093e9f55a2Affected
65cff70464068a823b3f4a28074000febdce0630 to before bd7139a70ee8d8ea872b223e043730cf6f5e2b0eAffected
65cff70464068a823b3f4a28074000febdce0630 to before ee0166b637a5e376118e9659e5b4148080f1d27eAffected

LinuxLinux

5.10Affected
before 5.10Not affected
5.15.203 through 5.15.*Not affected
6.1.91 through 6.1.*Not affected
6.6.31 through 6.6.*Not affected
6.8.10 through 6.8.*Not affected
6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.