Riskcovery

CVE-2024-44988

net: dsa: mv88e6xxx: Fix out-of-bound access

State
Published
Severity
8.8 High
Published
Sep 4, 2024
Updated
Aug 5, 2026
Reserved
Aug 21, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: mv88e6xxx: Fix out-of-bound access

If an ATU violation was caused by a CPU Load operation, the SPID could be larger than DSA_MAX_PORTS (the size of mv88e6xxx_chip.ports[] array).

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 27a2fa0098171199022affa76bdf15d77585457f to before 4a88fca95c8df3746b71e31f44a02d35f06f9864Affected
  • 75c05a74e745ae7d663b04d75777af80ada2233c to before d39f5be62f098fe367d672b4dd4bc4b2b80e08e7Affected
  • 75c05a74e745ae7d663b04d75777af80ada2233c to before 050e7274ab2150cd212b2372595720e7b83a15bdAffected
  • 75c05a74e745ae7d663b04d75777af80ada2233c to before a10d0337115a6d223a1563d853d4455f05d0b2e3Affected
  • 75c05a74e745ae7d663b04d75777af80ada2233c to before 18b2e833daf049223ab3c2efdf8cdee08854c484Affected
  • 75c05a74e745ae7d663b04d75777af80ada2233c to before f7d8c2fabd39250cf2333fbf8eef67e837f90a5dAffected
  • 75c05a74e745ae7d663b04d75777af80ada2233c to before f87ce03c652dba199aef15ac18ade3991db5477eAffected
  • 75c05a74e745ae7d663b04d75777af80ada2233c to before 528876d867a23b5198022baf2e388052ca67c952Affected
  • 1657d2814e83d3e338d6d60c5829d15d86645bc0Affected
  • 4.19.21 to before 4.19.323Affected
  • 4.20.8 to before 4.21Affected
LinuxLinux
  • 5.0Affected
  • before 5.0Not affected
  • 4.19.323 through 4.19.*Not affected
  • 5.4.283 through 5.4.*Not affected
  • 5.10.225 through 5.10.*Not affected
  • 5.15.166 through 5.15.*Not affected
  • 6.1.107 through 6.1.*Not affected
  • 6.6.48 through 6.6.*Not affected
  • 6.10.7 through 6.10.*Not affected
  • 6.11 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.