---
id: CVE-2024-39482
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bcache: fix variable length array abuse in btree_iter

  btree_iter is used in two ways: either allocated on the stack with a
  fixed size MAX_BSETS, or from a mempool with…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bcache: fix variable length array abuse in btree_iter

  btree_iter is used in two ways: either allocated on the stack with a
  fixed size MAX_BSETS, or from a mempool with…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-770
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.10, < 5.10.221'
  - 'linux_kernel >= 5.15, < 5.15.162'
  - 'linux_kernel >= 6.1, < 6.1.94'
  - 'linux_kernel >= 6.6, < 6.6.34'
  - 'linux_kernel >= 6.9, < 6.9.5'
patched:
  - linux_kernel 6.9.5
published: '2024-07-05'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:18:33.800'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-39482'
references:
  - url: 'https://git.kernel.org/stable/c/0c31344e22dd8d6b1394c6e4c41d639015bdc671'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2c3d7b03b658dc8bfa6112b194b67b92a87e081b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5a1922adc5798b7ec894cd3f197afb6f9591b023'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6479b9f41583b013041943c4602e1ad61cec8148'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/934e1e4331859183a861f396d7dfaf33cb5afb02'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0c31344e22dd8d6b1394c6e4c41d639015bdc671'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/2c3d7b03b658dc8bfa6112b194b67b92a87e081b'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/5a1922adc5798b7ec894cd3f197afb6f9591b023'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/6479b9f41583b013041943c4602e1ad61cec8148'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/934e1e4331859183a861f396d7dfaf33cb5afb02'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-265688.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-355557.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-613116.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00238
epssPercentile: 0.14813
ingestedAt: '2026-10-15T03:30:12.716Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-07-08T17:54:07.988323Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bcache: fix variable length array abuse in btree_iter

btree_iter is used in two ways: either allocated on the stack with a
fixed size MAX_BSETS, or from a mempool with a dynamic size based on the
specific cache set. Previously, the struct had a fixed-length array of
size MAX_BSETS which was indexed out-of-bounds for the dynamically-sized
iterators, which causes UBSAN to complain.

This patch uses the same approach as in bcachefs's sort_iter and splits
the iterator into a btree_iter with a flexible array member and a
btree_iter_stack which embeds a btree_iter as well as a fixed-length
data array.

## Affected

- `linux_kernel >= 5.10, < 5.10.221`
- `linux_kernel >= 5.15, < 5.15.162`
- `linux_kernel >= 6.1, < 6.1.94`
- `linux_kernel >= 6.6, < 6.6.34`
- `linux_kernel >= 6.9, < 6.9.5`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.9.5`