Review reviewHigh

CVE-2024-36880

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: add missing firmware sanity checks Add the missing sanity checks when parsing the firmware files before downloading them to avoid accessing and corrupting memory beyond the vmalloced buffer.

CVSS: 7.8
EPSS: 0.25%
CISA KEV: Not listed
Published: 2024.05.31

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.25%

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Linux Linux, linux kernel
Affected versions: >= 83e81961ff7ef75f97756f316caea5aa6bcc19cc < ed53949cc92e28aaa3463d246942bda1fbb7f307, >= 83e81961ff7ef75f97756f316caea5aa6bcc19cc < 1caceadfb50432dbf6d808796cb6c34ebb6d662c, >= 83e81961ff7ef75f97756f316caea5aa6bcc19cc < 427281f9498ed614f9aabc80e46ec077c487da6d, >= 83e81961ff7ef75f97756f316caea5aa6bcc19cc < 02f05ed44b71152d5e11d29be28aed91c0489b4e, >= 83e81961ff7ef75f97756f316caea5aa6bcc19cc < 2e4edfa1e2bd821a317e7d006517dcf2f3fac68d, >= 4.3, >= 4.3 < 5.15.159, >= 5.16 < 6.1.91, >= 6.2 < 6.6.31, >= 6.7 < 6.8.10, 6.9
Fixed versions: 5.15.159, 6.1.91, 6.6.31, 6.8.10

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux Linux, linux kernel and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: Not available