CVE-2024-38602: linux
Vulnerability summary
CVE-2024-38602 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 29 · Related 27Timeline
- 19-06-2024PublishedVulnerability first disclosed.
- 23-05-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: ax25: Fix reference count leak issues of ax25_dev The ax25_addr_ax25dev() and ax25_dev_device_down() exist a reference count leak issue of the object "ax25_dev". Memory leak issue in ax25_addr_ax25dev(): The reference count of the object "ax25_dev" can be increased multiple times in ax25_addr_ax25dev(). This will cause a memory leak. Memory leak issues in ax25_dev_device_down(): The reference count of ax25_dev is set to 1 in ax25_dev_device_up() and then increase the reference count when ax25_dev is added to ax25_dev_list. As a result, the reference count of ax25_dev is 2. But when the device is shutting down. The ax25_dev_device_down() drops the reference count once or twice depending on if we goto unlock_put or not, which will cause memory leak. As for the issue of ax25_addr_ax25dev(), it is impossible for one pointer to be on a list twice. So add a break in ax25_addr_ax25dev(). As for the issue of ax25_dev_device_down(), increase the reference count of ax25_dev once in ax25_dev_device_up() and decrease the reference count of ax25_dev after it is removed from the ax25_dev_list.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.21%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
0.00 pp
From 0.21% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Ubuntu128 products
- linux< 4.4.0-260.294 | < 4.15.0-230.242 | < 5.4.0-200.220 | < 5.15.0-125.135 | < 6.8.0-40.40
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 4.4.0-1137.143 | < 4.4.0-1175.190 | < 4.15.0-1174.187 | < 5.4.0-1135.145 | < 5.15.0-1072.78 | < 6.8.0-1013.14
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ d01ffb9eee4af165d83b08dd73ebdf9fe94a519b, < ae467750a3765dd1092eb29f58247950a2f9b60c | ≥ d01ffb9eee4af165d83b08dd73ebdf9fe94a519b, < 38eb01edfdaa1562fa00429be2e33f45383b1b3a | ≥ d01ffb9eee4af165d83b08dd73ebdf9fe94a519b, < 81d8240b0a243b3ddd8fa8aa172f1acc2f7cc8f3 | ≥ d01ffb9eee4af165d83b08dd73ebdf9fe94a519b, < 1ea02699c7557eeb35ccff2bd822de1b3e09d868 | ≥ d01ffb9eee4af165d83b08dd73ebdf9fe94a519b, < b505e0319852b08a3a716b64620168eab21f4ced | ef0a2a0565727a48f2e36a2c461f8b1e3a61922d | e2b558fe507a1ed4c43db2b0057fc6e41f20a14c | 418993bbaafb0cd48f904ba68eeda052d624c821 | 5ea00fc60676c0eebfa8560ec461209d638bca9d | 9af0fd5c4453a44c692be0cbb3724859b75d739b | ≥ 4.14.277, < 4.15 | ≥ 4.19.240, < 4.20 | ≥ 5.4.190, < 5.5 | ≥ 5.10.112, < 5.11 | ≥ 5.15.35, < 5.16 | 5.17
- linux_kernel≥ 5.17, < 6.1.93 | ≥ 6.2, < 6.6.33 | ≥ 6.7, < 6.8.12 | ≥ 6.9, < 6.9.3
Debian1 product
- linux< 6.1.94-1 | < 6.8.12-1
3 vendors · 131 products
