CVE-2024-38635: linux Out-of-bounds Read
Vulnerability summary
CVE-2024-38635 is a high (CVSS 7.8) Out-of-bounds Read vulnerability in linux. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 13.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 31 · Related 27Timeline
- 21-06-2024PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: soundwire: cadence: fix invalid PDI offset For some reason, we add an offset to the PDI, presumably to skip the PDI0 and PDI1 which are reserved for BPT. This code is however completely wrong and leads to an out-of-bounds access. We were just lucky so far since we used only a couple of PDIs and remained within the PDI array bounds. A Fixes: tag is not provided since there are no known platforms where the out-of-bounds would be accessed, and the initial code had problems as well. A follow-up patch completely removes this useless offset.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HDiffers
- NVDNIST7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HDiffers
EPSS trend
Probability
0.24%
Chance of exploitation in the next 30 days
Percentile
13%
Versus all other CVEs
30-day change
0.00 pp
From 0.24% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu129 products
- linuxAll versions (No fix recorded) | < 5.4.0-192.212 | < 5.15.0-121.131 | < 6.8.0-44.44
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.4.0-1130.140 | < 5.15.0-1069.75 | < 6.8.0-1015.16
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 002364b2d594a9afc0385c09e00994c510b1d089 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < fd4bcb991ebaf0d1813d81d9983cfa99f9ef5328 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 902f6d656441a511ac25c6cffce74496db10a078 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 2ebcaa0e5db9b6044bb487ae1cf41bc601761567 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 7eeef1e935d23db5265233d92395bd5c648a4021 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 4e99103f757cdf636c6ee860994a19a346a11785 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 8ee1b439b1540ae543149b15a2a61b9dff937d91 | < 5.4.278 | < 5.10.219 | < 5.15.161 | < 6.1.93 | < 6.6.33 | < 6.9.4
- linux_kernel< 5.4.278 | ≥ 5.5, < 5.10.219 | ≥ 5.11, < 5.15.161 | ≥ 5.16, < 6.1.93 | ≥ 6.2, < 6.6.33 | ≥ 6.7, < 6.9.4
Debian1 product
- linux< 6.1.94-1 | < 6.9.7-1
3 vendors · 132 products
