CVE-2024-50268: linux Out-of-bounds Read
Vulnerability summary
CVE-2024-50268 is a high (CVSS 7.8) Out-of-bounds Read vulnerability in linux. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 38 · Related 37Timeline
- 19-11-2024PublishedVulnerability first disclosed.
- 05-08-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() The "*cmd" variable can be controlled by the user via debugfs. That means "new_cam" can be as high as 255 while the size of the uc->updated[] array is UCSI_MAX_ALTMODES (30). The call tree is: ucsi_cmd() // val comes from simple_attr_write_xsigned() -> ucsi_send_command() -> ucsi_send_command_common() -> ucsi_run_command() // calls ucsi->ops->sync_control() -> ucsi_ccg_sync_control()
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HDiffers
- NVDNIST7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HDiffers
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
17%
Versus all other CVEs
30-day change
0.00 pp
From 0.26% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu122 products
- linux< 5.15.0-133.144 | < 6.8.0-58.60
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 5.15.0-1078.85 | < 6.8.0-1027.29
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 170a6726d0e266f2c8f306e3d61715c32f4ee41e, < d76923164705821aa1b01b8d9d1741f20c654ab4 | ≥ 170a6726d0e266f2c8f306e3d61715c32f4ee41e, < 8f47984b35f3be0cfc652c2ca358d5768ea3456b | ≥ 170a6726d0e266f2c8f306e3d61715c32f4ee41e, < 604314ecd682913925980dc955caea2d036eab5f | ≥ 170a6726d0e266f2c8f306e3d61715c32f4ee41e, < 69e19774f15e12dda6c6c58001d059e30895009b | ≥ 170a6726d0e266f2c8f306e3d61715c32f4ee41e, < 3a2ba841659a0f15102585120dea75d8d5209616 | ≥ 170a6726d0e266f2c8f306e3d61715c32f4ee41e, < 7dd08a0b4193087976db6b3ee7807de7e8316f96 | 5.6
- linux_kernel≥ 5.6, < 5.10.230 | ≥ 5.11, < 5.15.172 | ≥ 5.16, < 6.1.117 | ≥ 6.2, < 6.6.61 | ≥ 6.7, < 6.11.8 | 6.12:rc1 | 6.12:rc2 | 6.12:rc3 | 6.12:rc4 | 6.12:rc5 | 6.12:rc6
Debian1 product
- linux< 6.1.119-1 | < 6.11.9-1
3 vendors · 125 products
