CVE-2024-46836: linux Improper Validation of Array Index
CVSS: 7.8v3.1HighModified
AliasesUBUNTU-CVE-2024-46836DEBIAN-CVE-2024-46836
Published 27-09-2024Last modified 11-05-2026
Vulnerability summary
CVE-2024-46836 is a high (CVSS 7.8) Improper Validation of Array Index vulnerability in linux. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.5% of scored vulnerabilities.
CVSS score
7.8/10
010
High · v3.1 (NVD)EPSS score
0.24%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 15 · Related 13Timeline
- 27-09-2024PublishedVulnerability first disclosed.
- 11-05-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed_udc: validate endpoint index for ast udc We should verify the bound of the array to assure that host may not manipulate the index to point past endpoint array. Found by static analysis.
CVSS metrics
4 scores · 3 sources · 2 versionsLow 2.4Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NSourcesSingle source
High 7.8Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.24%
Chance of exploitation in the next 30 days
Percentile
15%
Versus all other CVEs
30-day change
0.00 pp
From 0.24% on 18-09-2026
18-09-202618-10-2026
EPSS score0.24%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu98 products
- linux< 6.8.0-50.51
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 6.8.0-1020.22
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 055276c1320564b0192b3af323b8cc67f9b665e1, < 31bd4fab49c0adc6228848357c1b1df9395858af | ≥ 055276c1320564b0192b3af323b8cc67f9b665e1, < b2a50ffdd1a079869a62198a8d1441355c513c7c | ≥ 055276c1320564b0192b3af323b8cc67f9b665e1, < 6fe9ca2ca389114c8da66e534c18273497843e8a | ≥ 055276c1320564b0192b3af323b8cc67f9b665e1, < ee0d382feb44ec0f445e2ad63786cd7f3f6a8199 | 6.0
- linux_kernel< 6.1.110 | ≥ 6.2, < 6.6.51 | ≥ 6.7, < 6.10.10
Debian1 product
- linux< 6.1.112-1 | < 6.10.11-1
3 vendors · 101 products
