--- title: "CVE-2024-50302: HID: core: zero-initialize the report… | CubePath" description: "In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all…" language: en source: https://cubepath.com/security/cve/CVE-2024-50302 --- # CVE-2024-50302: HID: core: zero-initialize the report… | CubePath ## Description In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report. Official description from the CVE record, published by Linux. Copyright © 1999-2026 The MITRE Corporation. See [/security/cve/legal](https://cubepath.com/security/cve/legal) for the CVE license. [View the record on cve.org](https://www.cve.org/CVERecord?id=CVE-2024-50302) ## Key data ### CVSS 3.1 Medium 5.5 Score published by CISA-ADP in the CVE record. CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | Metric | Value | What it means | | ---------------------- | --------- | ----------------------------------------------------------------------------------------- | | Attack vector | Local | The attacker needs local access to the system, or to trick a user into running something. | | Attack complexity | Low | No special conditions are needed. The attack can be repeated at will. | | Privileges required | Low | A basic user account is needed. | | User interaction | None | No action from any user is needed. | | Scope | Unchanged | The impact stays within the vulnerable component. | | Confidentiality impact | High | Serious or total effect on the secrecy of data. | | Integrity impact | None | No effect on the trustworthiness of data. | | Availability impact | None | No effect on availability. | CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and is used by permission. Each CVSS score on this site is shown together with its vector string, as published in the CVE record by the source named next to it. Learn more at [first.org/cvss](https://www.first.org/cvss/) . ### EPSS Exploit Prediction Scoring System by FIRST: an estimate of the probability that exploitation activity will be observed in the next 30 days. Score 0.00811 (0.8% probability) Percentile 57.2% Scores of Nov 10, 2026 Model v2026.06.15 ### CISA Known Exploited Vulnerabilities This CVE is listed in the CISA KEV catalog. Name in the catalog Linux Kernel Use of Uninitialized Resource Vulnerability Added to the catalog Mar 4, 2025 Federal due date Mar 25, 2025 ### CISA assessment as of Mar 5, 2025 Stakeholder-Specific Vulnerability Categorization (SSVC) decision points added by CISA. Exploitation Recorded by CISA as active Automatable no Technical impact partial ### Weakness (CWE) CWE catalog version 5.0. CWE names: Copyright © 2006-2026, The MITRE Corporation. See [/security/cve/legal](https://cubepath.com/security/cve/legal) for the CWE license. - [CWE-908](https://cwe.mitre.org/data/definitions/908.html) Use of Uninitialized Resource ## Affected products Products listed in the CVE record, as the CNA published them. - Linux - affected: 27ce405039bfe6d3f4143415c638f56a3df77dca up to before e7ea60184e1e88a3c9e437b3265cbb6439aa7e26 - affected: 27ce405039bfe6d3f4143415c638f56a3df77dca up to before 3f9e88f2672c4635960570ee9741778d4135ecf5 - affected: 27ce405039bfe6d3f4143415c638f56a3df77dca up to before d7dc68d82ab3fcfc3f65322465da3d7031d4ab46 - affected: 27ce405039bfe6d3f4143415c638f56a3df77dca up to before 05ade5d4337867929e7ef664e7ac8e0c734f1aaf - affected: 27ce405039bfe6d3f4143415c638f56a3df77dca up to before 1884ab3d22536a5c14b17c78c2ce76d1734e8b0b - affected: 27ce405039bfe6d3f4143415c638f56a3df77dca up to before 9d9f5c75c0c7f31766ec27d90f7a6ac673193191 - affected: 27ce405039bfe6d3f4143415c638f56a3df77dca up to before 492015e6249fbcd42138b49de3c588d826dd9648 - affected: 27ce405039bfe6d3f4143415c638f56a3df77dca up to before 177f25d1292c7e16e1199b39c85480f7f8815552 - affected: b2b6cadad699d44a8a5b2a60f3d960e00d6fb3b7 - affected: fe6c9b48ebc920ff21c10c50ab2729440c734254 - affected: 3.10.16 up to before 3.11 - affected: 3.11.5 up to before 3.12 - Linux - affected: 3.12 - unaffected: before 3.12 - unaffected: 4.19.324 up to 4.19.\* - unaffected: 5.4.286 up to 5.4.\* - unaffected: 5.10.230 up to 5.10.\* - unaffected: 5.15.172 up to 5.15.\* - unaffected: 6.1.117 up to 6.1.\* - unaffected: 6.6.61 up to 6.6.\* - unaffected: 6.11.8 up to 6.11.\* - unaffected: 6.12 up to \* ## References Links listed in the CVE record. They lead to other sites, which CubePath does not control. - [git.kernel.org/stable/c/e7ea60184e1e88a3c9e437b3265cbb6439a…](https://git.kernel.org/stable/c/e7ea60184e1e88a3c9e437b3265cbb6439aa7e26) - [git.kernel.org/stable/c/3f9e88f2672c4635960570ee9741778d413…](https://git.kernel.org/stable/c/3f9e88f2672c4635960570ee9741778d4135ecf5) - [git.kernel.org/stable/c/d7dc68d82ab3fcfc3f65322465da3d7031d…](https://git.kernel.org/stable/c/d7dc68d82ab3fcfc3f65322465da3d7031d4ab46) - [git.kernel.org/stable/c/05ade5d4337867929e7ef664e7ac8e0c734…](https://git.kernel.org/stable/c/05ade5d4337867929e7ef664e7ac8e0c734f1aaf) - [git.kernel.org/stable/c/1884ab3d22536a5c14b17c78c2ce76d1734…](https://git.kernel.org/stable/c/1884ab3d22536a5c14b17c78c2ce76d1734e8b0b) - [git.kernel.org/stable/c/9d9f5c75c0c7f31766ec27d90f7a6ac6731…](https://git.kernel.org/stable/c/9d9f5c75c0c7f31766ec27d90f7a6ac673193191) - [git.kernel.org/stable/c/492015e6249fbcd42138b49de3c588d826d…](https://git.kernel.org/stable/c/492015e6249fbcd42138b49de3c588d826dd9648) - [git.kernel.org/stable/c/177f25d1292c7e16e1199b39c85480f7f88…](https://git.kernel.org/stable/c/177f25d1292c7e16e1199b39c85480f7f8815552) - [lists.debian.org/debian-lts-announce/2025/03/msg00002.html](https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html) - [lists.debian.org/debian-lts-announce/2025/01/msg00001.html](https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html) ## Timeline 1. ID reserved Oct 21, 2024 2. Record published Nov 19, 2024 3. Added to CISA KEV Mar 4, 2025 4. Record last updated Oct 15, 2026 ## Look up another CVE ## About CubePath CubePath is a cloud provider with data centers in Europe and the United States. It offers VPS, bare metal servers and DDoS protection. [Cloud VPS](https://cubepath.com/vps) [DDoS protection](https://cubepath.com/ddos-protection) Data from the CVE Program (MITRE), CISA KEV and FIRST EPSS. CVSS is owned by FIRST and used by permission. Not affiliated with or endorsed by MITRE, CISA or FIRST. Data as of Nov 10, 2026, 19:18 UTC. [Sources and licenses](https://cubepath.com/security/cve/legal)