---
id: CVE-2024-38559
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: qedf: Ensure the copied buf is NUL terminated

  Currently, we allocate a count-sized kernel buffer and copy count from
  userspace to that buffer
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: qedf: Ensure the copied buf is NUL terminated

  Currently, we allocate a count-sized kernel buffer and copy count from
  userspace to that buffer. Later, we use kstr…
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-476
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 4.11, < 4.19.316'
  - 'linux_kernel >= 4.20, < 5.4.278'
  - 'linux_kernel >= 5.5, < 5.10.219'
  - 'linux_kernel >= 5.11, < 5.15.161'
  - 'linux_kernel >= 5.16, < 6.1.93'
  - 'linux_kernel >= 6.2, < 6.6.33'
  - 'linux_kernel >= 6.7, < 6.8.12'
  - 'linux_kernel >= 6.9, < 6.9.3'
patched:
  - linux_kernel 6.9.3
published: '2024-06-19'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:18:28.737'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-38559'
references:
  - url: 'https://git.kernel.org/stable/c/177f43c6892e6055de6541fe9391a8a3d1f95fc9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/1f84a2744ad813be23fc4be99fb74bfb24aadb95'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4907f5ad246fa9b51093ed7dfc7da9ebbd3f20b8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/563e609275927c0b75fbfd0d90441543aa7b5e0d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/769b9fd2af02c069451fe9108dba73355d9a021c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a75001678e1d38aa607d5b898ec7ff8ed0700d59'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d0184a375ee797eb657d74861ba0935b6e405c62'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d93318f19d1e1a6d5f04f5d965eaa9055bb7c613'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dccd97b39ab2f2b1b9a47a1394647a4d65815255'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/177f43c6892e6055de6541fe9391a8a3d1f95fc9'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/1f84a2744ad813be23fc4be99fb74bfb24aadb95'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/4907f5ad246fa9b51093ed7dfc7da9ebbd3f20b8'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/563e609275927c0b75fbfd0d90441543aa7b5e0d'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/769b9fd2af02c069451fe9108dba73355d9a021c'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/a75001678e1d38aa607d5b898ec7ff8ed0700d59'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/d0184a375ee797eb657d74861ba0935b6e405c62'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/d93318f19d1e1a6d5f04f5d965eaa9055bb7c613'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/dccd97b39ab2f2b1b9a47a1394647a4d65815255'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-265688.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00253
epssPercentile: 0.16745
ingestedAt: '2026-10-15T03:30:12.705Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-06-24T15:39:36.404554Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: qedf: Ensure the copied buf is NUL terminated

Currently, we allocate a count-sized kernel buffer and copy count from
userspace to that buffer. Later, we use kstrtouint on this buffer but we
don't ensure that the string is terminated inside the buffer, this can
lead to OOB read when using kstrtouint. Fix this issue by using
memdup_user_nul instead of memdup_user.

## Affected

- `linux_kernel >= 4.11, < 4.19.316`
- `linux_kernel >= 4.20, < 5.4.278`
- `linux_kernel >= 5.5, < 5.10.219`
- `linux_kernel >= 5.11, < 5.15.161`
- `linux_kernel >= 5.16, < 6.1.93`
- `linux_kernel >= 6.2, < 6.6.33`
- `linux_kernel >= 6.7, < 6.8.12`
- `linux_kernel >= 6.9, < 6.9.3`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.9.3`