8.8

CVE-2024-38381: linux Use of Uninitialized Resource

CVSS: 8.8v3.1HighModified
AliasesUBUNTU-CVE-2024-38381DEBIAN-CVE-2024-38381CGA-2ghg-39f2-r398
Published 21-06-2024Last modified 15-10-2026
Open JSON

Vulnerability summary

CVE-2024-38381 is a high (CVSS 8.8) Use of Uninitialized Resource vulnerability in linux. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.2% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.38%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 33 · Related 30
DLA-3840-1DSA-5730-1MGASA-2024-0263MGASA-2024-0266SUSE-SU-2024:2372-1SUSE-SU-2024:2394-1

Timeline

  1. 21-06-2024
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix uninit-value in nci_rx_work syzbot reported the following uninit-value access issue [1] nci_rx_work() parses received packet from ndev->rx_q. It should be validated header size, payload size and total packet size before processing the packet. If an invalid packet is detected, it should be silently discarded.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.38%

Chance of exploitation in the next 30 days

Percentile

30%

Versus all other CVEs

30-day change

0.00 pp

From 0.38% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.38%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu110 products
  • linux< 5.4.0-192.212 | < 5.15.0-121.131 | < 6.8.0-44.44
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.4.0-1130.140 | < 5.15.0-1069.75 | < 6.8.0-1015.16
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Chainguard24 products
  • hyperv-daemons-genericAll versions (No fix recorded)
  • linux-aws-6.12All versions (No fix recorded)
  • linux-aws-6.18All versions (No fix recorded)
  • linux-aws-genericAll versions (No fix recorded)
  • linux-aws-generic-boot-installedAll versions (No fix recorded)
Linux2 products
  • linux≥ 11387b2effbb55f58dc2111ef4b4b896f2756240, < 406cfac9debd4a6d3dc5d9258ee086372a8c08b6 | ≥ 03fe259649a551d336a7f20919b641ea100e3fff, < 485ded868ed62ceb2acb3a459d7843fd71472619 | ≥ 755e53bbc61bc1aff90eafa64c8c2464fd3dfa3c, < f80b786ab0550d0020191a59077b2c7e069db2d1 | ≥ ac68d9fa09e410fa3ed20fb721d56aa558695e16, < ad4d196d2008c7f413167f0a693feb4f0439d7fe | ≥ b51ec7fc9f877ef869c01d3ea6f18f6a64e831a7, < e8c8e0d0d214c877fbad555df5b3ed558cd9b0c3 | ≥ a946ebee45b09294c8b0b0e77410b763c4d2817a, < e53a7f8afcbd2886f2a94c5d56757328109730ea | ≥ d24b03535e5eb82e025219c2f632b485409c898f, < 017ff397624930fd7ac7f1761f3c9d6a7100f68c | ≥ d24b03535e5eb82e025219c2f632b485409c898f, < e4a87abf588536d1cdfb128595e6e680af5cf3ed | 8948e30de81faee87eeee01ef42a1f6008f5a83a | ≥ 4.19.312, < 4.19.316 | ≥ 5.4.274, < 5.4.278 | ≥ 5.10.215, < 5.10.219 | ≥ 5.15.154, < 5.15.161 | ≥ 6.1.85, < 6.1.93 | ≥ 6.6.26, < 6.6.33 | ≥ 6.8.5, < 6.9 | 6.9
  • linux_kernel≥ 4.19.312, < 4.19.316 | ≥ 5.4.274, < 5.4.278 | ≥ 5.10.215, < 5.10.219 | ≥ 5.15.154, < 5.15.161 | ≥ 6.1.85, < 6.1.93 | ≥ 6.6.26, < 6.6.33 | ≥ 6.8.5, < 6.9.4
Debian1 product
  • linux< 6.1.94-1 | < 6.9.7-1

4 vendors · 137 products

References

36 links
Show all 36 references