{"id":"CVE-2024-42276","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: add missing condition check for existence of mapped data\n\nnvme_map_data() is called when request has physical segments, hence\nthe nvme_unmap_data() should hav…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: add missing condition check for existence of mapped data\n\nnvme_map_data() is called when request has physical segments, hence\nthe nvme_unmap_data() should hav…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 5.2, < 5.4.282","linux_kernel >= 5.5, < 5.10.224","linux_kernel >= 5.11, < 5.15.165","linux_kernel >= 5.16, < 6.1.103","linux_kernel >= 6.2, < 6.6.44","linux_kernel >= 6.7, < 6.10.3"],"patched":["linux_kernel 6.10.3"],"published":"2024-08-17","updated":"2026-10-15","sourceUpdated":"2026-10-15T01:18:45.217","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-42276","references":[{"url":"https://git.kernel.org/stable/c/3f8ec1d6b0ebd8268307d52be8301973fa5a01ec","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/70100fe721840bf6d8e5abd25b8bffe4d2e049b7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/77848b379e9f85a08048a2c8b3b4a7e8396f5f83","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7cc1f4cd90a00b6191cb8cda2d1302fdce59361c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/be23ae63080e0bf9e246ab20207200bca6585eba","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c31fad1470389666ac7169fe43aa65bf5b7e2cfd","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d135c3352f7c947a922da93c8e763ee6bc208b64","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-42276.json"},{"url":"https://access.redhat.com/security/cve/CVE-2024-42276"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2305421"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-42276"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42276"},{"url":"https://lore.kernel.org/linux-cve-announce/2024081741-CVE-2024-42276-cb0a@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2024:9315"}],"tags":["nvd","cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00246,"epssPercentile":0.15734,"ingestedAt":"2026-10-15T03:30:12.731Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-09-10T16:11:52.374763Z"},"cwe":["CWE-476"],"scores":{"nvd":7.8,"vendor":4.4},"slug":"CVE-2024-42276","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: add missing condition check for existence of mapped data\n\nnvme_map_data() is called when request has physical segments, hence\nthe nvme_unmap_data() should have same condition to avoid dereference.\n\n## Affected\n\n- `linux_kernel >= 5.2, < 5.4.282`\n- `linux_kernel >= 5.5, < 5.10.224`\n- `linux_kernel >= 5.11, < 5.15.165`\n- `linux_kernel >= 5.16, < 6.1.103`\n- `linux_kernel >= 6.2, < 6.6.44`\n- `linux_kernel >= 6.7, < 6.10.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.10.3`\n\n## Vendor advisories\n\n- **RHSA-2024:9315** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2024-11-12 · [advisory](https://access.redhat.com/errata/RHSA-2024:9315)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-42276.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}