CVE-2024-27436: debian debian_linux Out-of-bounds Write
CVSS: 5.5v3.1MediumModified
AliasesUBUNTU-CVE-2024-27436DEBIAN-CVE-2024-27436
Published 17-05-2024Last modified 15-10-2026
Vulnerability summary
CVE-2024-27436 is a medium (CVSS 5.5) Out-of-bounds Write vulnerability in debian debian_linux. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 48.7% of scored vulnerabilities.
CVSS score
5.5/10
010
Medium · v3.1 (NVD)EPSS score
0.62%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 39 · Related 36DLA-3840-1DLA-3842-1RHSA-2024:9315SUSE-SU-2024:1979-1SUSE-SU-2024:1983-1SUSE-SU-2024:2008-1SUSE-SU-2024:2019-1SUSE-SU-2024:2135-1SUSE-SU-2024:2184-1SUSE-SU-2024:2190-1SUSE-SU-2024:2203-1SUSE-SU-2024:2973-1SUSE-SU-2025:20008-1SUSE-SU-2025:20028-1SUSE-SU-2025:20166-1SUSE-SU-2025:20249-1USN-6816-1USN-6817-1USN-6817-2USN-6817-3USN-6820-1USN-6820-2USN-6821-1USN-6821-2USN-6821-3USN-6821-4USN-6828-1USN-6871-1USN-6878-1USN-6892-1USN-6896-1USN-6896-2USN-6896-3USN-6896-4USN-6896-5USN-6919-1USN-7069-1USN-7069-2USN-7110-1
Timeline
- 17-05-2024PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Stop parsing channels bits when all channels are found. If a usb audio device sets more bits than the amount of channels it could write outside of the map array.
CVSS metrics
4 scores · 4 sources · 1 versionMedium 5.5Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSources4 sources · 5.3–5.5
- CVE.orgCNA5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.62%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
0.00 pp
From 0.62% on 18-09-2026
18-09-202618-10-2026
EPSS score0.62%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu117 products
- linuxAll versions (No fix recorded) | < 4.4.0-260.294 | < 4.15.0-230.242 | < 5.4.0-189.209 | < 5.15.0-112.122 | < 6.8.0-35.35
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 4.4.0-1137.143 | < 4.4.0-1175.190 | < 4.15.0-1174.187 | < 5.4.0-1128.138 | < 5.15.0-1063.69 | < 6.8.0-1009.9
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Debian2 products
- linux< 6.1.85-1 | < 6.7.12-1
- debian_linuxEOL10.0
Linux2 products
- linux≥ 04324ccc75f96b3ed7aad1c866d1b7925e977bdf, < 7e2c1b0f6dd9abde9e60f0f9730026714468770f | ≥ 04324ccc75f96b3ed7aad1c866d1b7925e977bdf, < 6d5dc96b154be371df0d62ecb07efe400701ed8a | ≥ 04324ccc75f96b3ed7aad1c866d1b7925e977bdf, < 5cd466673b34bac369334f66cbe14bb77b7d7827 | ≥ 04324ccc75f96b3ed7aad1c866d1b7925e977bdf, < 9af1658ba293458ca6a13f70637b9654fa4be064 | ≥ 04324ccc75f96b3ed7aad1c866d1b7925e977bdf, < 629af0d5fe94a35f498ba2c3f19bd78bfa591be6 | ≥ 04324ccc75f96b3ed7aad1c866d1b7925e977bdf, < 22cad1b841a63635a38273b799b4791f202ade72 | ≥ 04324ccc75f96b3ed7aad1c866d1b7925e977bdf, < c8a24fd281dcdf3c926413dafbafcf35cde517a9 | ≥ 04324ccc75f96b3ed7aad1c866d1b7925e977bdf, < 6d88b289fb0a8d055cb79d1c46a56aba7809d96d | ≥ 04324ccc75f96b3ed7aad1c866d1b7925e977bdf, < a39d51ff1f52cd0b6fe7d379ac93bd8b4237d1b7 | 3.8
- linux_kernel≥ 3.8, < 4.19.311 | ≥ 4.20, < 5.4.273 | ≥ 5.5, < 5.10.214 | ≥ 5.11, < 5.15.153 | ≥ 5.16, < 6.1.83 | ≥ 6.2, < 6.6.23 | ≥ 6.7, < 6.7.11 | ≥ 6.8, < 6.8.2
3 vendors · 121 products
