CubePath
Sign Up

CVE-2024-50302

HID: core: zero-initialize the report buffer

CVSS 3.1 Medium 5.5Known exploited (CISA KEV)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report.

Official description from the CVE record, published by Linux. Copyright © 1999-2026 The MITRE Corporation. See /security/cve/legal for the CVE license. View the record on cve.org

Key data

CVSS 3.1 Medium 5.5

Score published by CISA-ADP in the CVE record.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

  • Attack vector: Local

    The attacker needs local access to the system, or to trick a user into running something.

  • Attack complexity: Low

    No special conditions are needed. The attack can be repeated at will.

  • Privileges required: Low

    A basic user account is needed.

  • User interaction: None

    No action from any user is needed.

  • Scope: Unchanged

    The impact stays within the vulnerable component.

  • Confidentiality impact: High

    Serious or total effect on the secrecy of data.

  • Integrity impact: None

    No effect on the trustworthiness of data.

  • Availability impact: None

    No effect on availability.

CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and is used by permission. Each CVSS score on this site is shown together with its vector string, as published in the CVE record by the source named next to it. Learn more at first.org/cvss.

EPSS

Exploit Prediction Scoring System by FIRST: an estimate of the probability that exploitation activity will be observed in the next 30 days.
Score
0.00811 (0.8% probability)
Percentile
57.2%
Scores of
Nov 10, 2026
Model
v2026.06.15

CISA Known Exploited Vulnerabilities

This CVE is listed in the CISA KEV catalog.
Name in the catalog
Linux Kernel Use of Uninitialized Resource Vulnerability
Added to the catalog
Mar 4, 2025
Federal due date
Mar 25, 2025

CISA assessment as of Mar 5, 2025

Stakeholder-Specific Vulnerability Categorization (SSVC) decision points added by CISA.
Exploitation
Recorded by CISA as active
Automatable
no
Technical impact
partial

Weakness (CWE)

CWE catalog version 5.0.
CWE names: Copyright © 2006-2026, The MITRE Corporation. See /security/cve/legal for the CWE license.
  • CWE-908Use of Uninitialized Resource

Affected products

Products listed in the CVE record, as the CNA published them.

  • Linux

    • affected: 27ce405039bfe6d3f4143415c638f56a3df77dca up to before e7ea60184e1e88a3c9e437b3265cbb6439aa7e26
    • affected: 27ce405039bfe6d3f4143415c638f56a3df77dca up to before 3f9e88f2672c4635960570ee9741778d4135ecf5
    • affected: 27ce405039bfe6d3f4143415c638f56a3df77dca up to before d7dc68d82ab3fcfc3f65322465da3d7031d4ab46
    • affected: 27ce405039bfe6d3f4143415c638f56a3df77dca up to before 05ade5d4337867929e7ef664e7ac8e0c734f1aaf
    • affected: 27ce405039bfe6d3f4143415c638f56a3df77dca up to before 1884ab3d22536a5c14b17c78c2ce76d1734e8b0b
    • affected: 27ce405039bfe6d3f4143415c638f56a3df77dca up to before 9d9f5c75c0c7f31766ec27d90f7a6ac673193191
    • affected: 27ce405039bfe6d3f4143415c638f56a3df77dca up to before 492015e6249fbcd42138b49de3c588d826dd9648
    • affected: 27ce405039bfe6d3f4143415c638f56a3df77dca up to before 177f25d1292c7e16e1199b39c85480f7f8815552
    • affected: b2b6cadad699d44a8a5b2a60f3d960e00d6fb3b7
    • affected: fe6c9b48ebc920ff21c10c50ab2729440c734254
    • affected: 3.10.16 up to before 3.11
    • affected: 3.11.5 up to before 3.12

  • Linux

    • affected: 3.12
    • unaffected: before 3.12
    • unaffected: 4.19.324 up to 4.19.*
    • unaffected: 5.4.286 up to 5.4.*
    • unaffected: 5.10.230 up to 5.10.*
    • unaffected: 5.15.172 up to 5.15.*
    • unaffected: 6.1.117 up to 6.1.*
    • unaffected: 6.6.61 up to 6.6.*
    • unaffected: 6.11.8 up to 6.11.*
    • unaffected: 6.12 up to *

References

Links listed in the CVE record. They lead to other sites, which CubePath does not control.

Timeline

  1. ID reserved
  2. Record published
  3. Added to CISA KEV
  4. Record last updated

Look up another CVE

About CubePath

CubePath is a cloud provider with data centers in Europe and the United States. It offers VPS, bare metal servers and DDoS protection.
Cloud VPSDDoS protection

Data from the CVE Program (MITRE), CISA KEV and FIRST EPSS. CVSS is owned by FIRST and used by permission. Not affiliated with or endorsed by MITRE, CISA or FIRST. Data as of Nov 10, 2026, 19:51 UTC. Sources and licenses