{"id":"CVE-2024-39482","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nbcache: fix variable length array abuse in btree_iter\n\nbtree_iter is used in two ways: either allocated on the stack with a\nfixed size MAX_BSETS, or from a mempool with…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbcache: fix variable length array abuse in btree_iter\n\nbtree_iter is used in two ways: either allocated on the stack with a\nfixed size MAX_BSETS, or from a mempool with…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-770"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 5.10, < 5.10.221","linux_kernel >= 5.15, < 5.15.162","linux_kernel >= 6.1, < 6.1.94","linux_kernel >= 6.6, < 6.6.34","linux_kernel >= 6.9, < 6.9.5"],"patched":["linux_kernel 6.9.5"],"published":"2024-07-05","updated":"2026-10-15","sourceUpdated":"2026-10-15T01:18:33.800","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-39482","references":[{"url":"https://git.kernel.org/stable/c/0c31344e22dd8d6b1394c6e4c41d639015bdc671","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2c3d7b03b658dc8bfa6112b194b67b92a87e081b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5a1922adc5798b7ec894cd3f197afb6f9591b023","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6479b9f41583b013041943c4602e1ad61cec8148","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/934e1e4331859183a861f396d7dfaf33cb5afb02","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0c31344e22dd8d6b1394c6e4c41d639015bdc671","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/2c3d7b03b658dc8bfa6112b194b67b92a87e081b","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/5a1922adc5798b7ec894cd3f197afb6f9591b023","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/6479b9f41583b013041943c4602e1ad61cec8148","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/934e1e4331859183a861f396d7dfaf33cb5afb02","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-355557.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-613116.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00238,"epssPercentile":0.14813,"ingestedAt":"2026-10-15T03:30:12.716Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-07-08T17:54:07.988323Z"},"slug":"CVE-2024-39482","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbcache: fix variable length array abuse in btree_iter\n\nbtree_iter is used in two ways: either allocated on the stack with a\nfixed size MAX_BSETS, or from a mempool with a dynamic size based on the\nspecific cache set. Previously, the struct had a fixed-length array of\nsize MAX_BSETS which was indexed out-of-bounds for the dynamically-sized\niterators, which causes UBSAN to complain.\n\nThis patch uses the same approach as in bcachefs's sort_iter and splits\nthe iterator into a btree_iter with a flexible array member and a\nbtree_iter_stack which embeds a btree_iter as well as a fixed-length\ndata array.\n\n## Affected\n\n- `linux_kernel >= 5.10, < 5.10.221`\n- `linux_kernel >= 5.15, < 5.15.162`\n- `linux_kernel >= 6.1, < 6.1.94`\n- `linux_kernel >= 6.6, < 6.6.34`\n- `linux_kernel >= 6.9, < 6.9.5`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.9.5`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}