CVE-2024-26970: debian debian_linux Out-of-bounds Read
Vulnerability summary
CVE-2024-26970 is a medium (CVSS 5.5) Out-of-bounds Read vulnerability in debian debian_linux. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 12.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 20 · Related 18Timeline
- 01-05-2024PublishedVulnerability first disclosed.
- 11-05-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where it is missing in order to avoid possible out-of-bound access when the table is traversed by functions like qcom_find_freq() or qcom_find_freq_floor(). Only compile tested.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.23%
Chance of exploitation in the next 30 days
Percentile
12%
Versus all other CVEs
30-day change
0.00 pp
From 0.23% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu105 products
- linux< 5.15.0-116.126 | < 6.8.0-35.35
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 5.15.0-1065.71 | < 6.8.0-1009.9
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Debian2 products
- linux< 6.1.85-1 | < 6.7.12-1
- debian_linuxEOL10.0
Linux2 products
- linux≥ d9db07f088af01a1080d01de363141b673c7d646, < ae60e3342296f766f88911d39199f77b05f657a6 | ≥ d9db07f088af01a1080d01de363141b673c7d646, < b4527ee3de365a742215773d20f07db3e2c06f3b | ≥ d9db07f088af01a1080d01de363141b673c7d646, < 852db52b45ea96dac2720f108e7c7331cd3738bb | ≥ d9db07f088af01a1080d01de363141b673c7d646, < 421b135aceace99789c982f6a77ce9476564fb52 | ≥ d9db07f088af01a1080d01de363141b673c7d646, < dcb13b5c9ae8743f99a96f392186527c3df89198 | ≥ d9db07f088af01a1080d01de363141b673c7d646, < db4066e3ab6b3d918ae2b92734a89c04fe82cc1d | ≥ d9db07f088af01a1080d01de363141b673c7d646, < cdbc6e2d8108bc47895e5a901cfcaf799b00ca8d | 5.6
- linux_kernel≥ 5.6, < 5.10.215 | ≥ 5.11, < 5.15.154 | ≥ 5.16, < 6.1.84 | ≥ 6.2, < 6.6.24 | ≥ 6.7, < 6.7.12 | ≥ 6.8, < 6.8.3
3 vendors · 109 products
References
25 links
lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlX TransferredMailing ListThird Party Advisory