Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2024-26927 Details

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Add some bounds checking to firmware data Smatch complains about "head->full_size - head->header_size" can underflow. To some extent, we're always going to have to trust the firmware a bit. However, it's easy enough to add a check for negatives, and let's add a upper bounds check as well.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: CISA-ADPCVSS-B:8.4 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://git.kernel.org/stable/c/044e220667157fb9d59320341badec59cf45ba48 kernel.orgPatch
https://git.kernel.org/stable/c/98f681b0f84cfc3a1d83287b77697679e0398306 kernel.orgPatch
https://git.kernel.org/stable/c/9eeb8e1231f6450c574c1db979122e171a1813ab kernel.orgPatch
https://git.kernel.org/stable/c/ced7df8b3c5c4751244cad79011e86cf1f809153 kernel.orgPatch
https://git.kernel.org/stable/c/d133d67e7e724102d1e53009c4f88afaaf3e167c kernel.orgPatch

see all 10 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')CISA-ADP

Affected Products

ProductVersions
linux linux kernel
>= 5.19, < 6.1.83
>= 6.2, < 6.6.23
>= 6.7, < 6.7.11
>= 6.8, < 6.8.2

CPE

  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

8 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2024-26927
NVD Published Date:
Apr 28, 2024
NVD Last Modified:
Jun 17, 2026
Source:
kernel.org
CVE-2024-26927 Details - Not Deferred