---
id: CVE-2024-38560
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: bfa: Ensure the copied buf is NUL terminated

  Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from
  userspace to that buffer
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: bfa: Ensure the copied buf is NUL terminated

  Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from
  userspace to that buffer. Later, we use ssc…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'
cwe:
  - CWE-125
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 3.19, < 4.19.316'
  - 'linux_kernel >= 4.20, < 5.4.278'
  - 'linux_kernel >= 5.5, < 5.10.219'
  - 'linux_kernel >= 5.11, < 5.15.161'
  - 'linux_kernel >= 5.16, < 6.1.93'
  - 'linux_kernel >= 6.2, < 6.6.33'
  - 'linux_kernel >= 6.7, < 6.8.12'
  - 'linux_kernel >= 6.9, < 6.9.3'
patched:
  - linux_kernel 6.9.3
published: '2024-06-19'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:18:28.987'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-38560'
references:
  - url: 'https://git.kernel.org/stable/c/00b425ff0891283207d7bad607a2412225274d7a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/13d0cecb4626fae67c00c84d3c7851f6b62f7df3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/1708e3cf2488788cba5489e4f913d227de757baf'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/204714e68015d6946279719fd464ecaf57240f35'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/481fc0c8617304a67649027c4a44723a139a0462'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/595a6b98deec01b6dbb20139f71edcd5fb760ec2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7510fab46b1cbd1680e2a096e779aec3334b4143'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7d3e694c4fe30f3aba9cd5ae86fb947a54c3db5c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ecb76200f5557a2886888aaa53702da1ab9e6cdf'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/00b425ff0891283207d7bad607a2412225274d7a'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/13d0cecb4626fae67c00c84d3c7851f6b62f7df3'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/1708e3cf2488788cba5489e4f913d227de757baf'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/204714e68015d6946279719fd464ecaf57240f35'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/481fc0c8617304a67649027c4a44723a139a0462'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/595a6b98deec01b6dbb20139f71edcd5fb760ec2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/7510fab46b1cbd1680e2a096e779aec3334b4143'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/7d3e694c4fe30f3aba9cd5ae86fb947a54c3db5c'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/ecb76200f5557a2886888aaa53702da1ab9e6cdf'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-265688.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00265
epssPercentile: 0.18311
ingestedAt: '2026-10-15T03:30:12.706Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-09-10T17:14:37.926935Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: bfa: Ensure the copied buf is NUL terminated

Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from
userspace to that buffer. Later, we use sscanf on this buffer but we don't
ensure that the string is terminated inside the buffer, this can lead to
OOB read when using sscanf. Fix this issue by using memdup_user_nul instead
of memdup_user.

## Affected

- `linux_kernel >= 3.19, < 4.19.316`
- `linux_kernel >= 4.20, < 5.4.278`
- `linux_kernel >= 5.5, < 5.10.219`
- `linux_kernel >= 5.11, < 5.15.161`
- `linux_kernel >= 5.16, < 6.1.93`
- `linux_kernel >= 6.2, < 6.6.33`
- `linux_kernel >= 6.7, < 6.8.12`
- `linux_kernel >= 6.9, < 6.9.3`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.9.3`