---
id: CVE-2024-50131
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tracing: Consider the NULL character when validating the event length

  strlen() returns a string length excluding the null byte
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tracing: Consider the NULL character when validating the event length

  strlen() returns a string length excluding the null byte. If the string
  length equals to the maxi…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H'
cwe:
  - CWE-120
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.1, < 5.15.170'
  - 'linux_kernel >= 5.16, < 6.1.115'
  - 'linux_kernel >= 6.2, < 6.6.59'
  - 'linux_kernel >= 6.7, < 6.11.6'
  - linux_kernel = 6.12
patched:
  - linux_kernel 6.11.6
published: '2024-11-05'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:19:07.857'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-50131'
references:
  - url: 'https://git.kernel.org/stable/c/02874ca52df2ca2423ba6122039315ed61c25972'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0b6e2e22cb23105fcb171ab92f0f7516c69c8471'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5e3231b352725ff4a3a0095e6035af674f2d8725'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5fd942598ddeed9a212d1ff41f9f5b47bcc990a7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a14a075a14af8d622c576145455702591bdde09d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b86b0d6eea204116e4185acc35041ca4ff11a642'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f4ed40d1c669bba1a54407d8182acdc405683f29'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-265688.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00247
epssPercentile: 0.1592
ingestedAt: '2026-10-15T03:30:12.764Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tracing: Consider the NULL character when validating the event length

strlen() returns a string length excluding the null byte. If the string
length equals to the maximum buffer length, the buffer will have no
space for the NULL terminating character.

This commit checks this condition and returns failure for it.

## Affected

- `linux_kernel >= 5.1, < 5.15.170`
- `linux_kernel >= 5.16, < 6.1.115`
- `linux_kernel >= 6.2, < 6.6.59`
- `linux_kernel >= 6.7, < 6.11.6`
- `linux_kernel = 6.12`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.11.6`