CVE-2024-38623

fs/ntfs3: Use variable length array instead of fixed size

State: Published
Severity: 7.8 High
Published: Jun 21, 2024
Updated: Aug 5, 2026
Reserved: Jun 18, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Use variable length array instead of fixed size

Should fix smatch warning: ntfs_set_label() error: __builtin_memcpy() 'uni->name' too small (20 vs 256)

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-129 Improper Validation of Array Index

Affected Products

Product	Versions
LinuxLinux	4534a70b7056fd4b9a1c6db5a4ce3c98546b291e to before a2de301d90b782ac5d7a5fe32995caaee9ab3a0fAffected 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e to before 3839a9b19a4b70eff6b6ad70446f639f7fd5a3d7Affected 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e to before 1fe1c9dc21ee52920629d2d9b9bd84358931a8d1Affected 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e to before cceef44b34819c24bb6ed70dce5b524bd3e368d1Affected 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e to before 1997cdc3e727526aa5d84b32f7cbb3f56459b7efAffected
LinuxLinux	5.15Affected before 5.15Not affected 5.15.161 through 5.15.Not affected 6.1.93 through 6.1.Not affected 6.6.33 through 6.6.Not affected 6.9.4 through 6.9.Not affected 6.10 and laterNot affected

Product

Versions

LinuxLinux

4534a70b7056fd4b9a1c6db5a4ce3c98546b291e to before a2de301d90b782ac5d7a5fe32995caaee9ab3a0fAffected
4534a70b7056fd4b9a1c6db5a4ce3c98546b291e to before 3839a9b19a4b70eff6b6ad70446f639f7fd5a3d7Affected
4534a70b7056fd4b9a1c6db5a4ce3c98546b291e to before 1fe1c9dc21ee52920629d2d9b9bd84358931a8d1Affected
4534a70b7056fd4b9a1c6db5a4ce3c98546b291e to before cceef44b34819c24bb6ed70dce5b524bd3e368d1Affected
4534a70b7056fd4b9a1c6db5a4ce3c98546b291e to before 1997cdc3e727526aa5d84b32f7cbb3f56459b7efAffected

LinuxLinux

5.15Affected
before 5.15Not affected
5.15.161 through 5.15.*Not affected
6.1.93 through 6.1.*Not affected
6.6.33 through 6.6.*Not affected
6.9.4 through 6.9.*Not affected
6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.