CVE-2024-53110

vp_vdpa: fix id_table array not null terminated error

State: Published
Severity: 7.3 High
Published: Dec 2, 2024
Updated: Aug 5, 2026
Reserved: Nov 19, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

vp_vdpa: fix id_table array not null terminated error

Allocate one extra virtio_device_id as null terminator, otherwise vdpa_mgmtdev_get_classes() may iterate multiple times and visit undefined memory.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H	Linux
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ffbda8e9df10d1784d5427ec199e7d8308e3763f to before 870d68fe17b5d9032049dcad98b5781a344a8657Affected ffbda8e9df10d1784d5427ec199e7d8308e3763f to before c4d64534d4b1c47d2f1ce427497f971ad4735aaeAffected ffbda8e9df10d1784d5427ec199e7d8308e3763f to before 0a886489d274596ad1a80789d3a773503210a615Affected ffbda8e9df10d1784d5427ec199e7d8308e3763f to before 4e39ecadf1d2a08187139619f1f314b64ba7d947Affected
LinuxLinux	5.19Affected before 5.19Not affected 6.1.119 through 6.1.Not affected 6.6.63 through 6.6.Not affected 6.11.10 through 6.11.*Not affected 6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.