CVE-2024-38577: rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• linux linux kernel5.8 and later · before 5.10.226
• linux linux kernel5.11 and later · before 5.15.167
• linux linux kernel5.16 and later · before 6.1.93
• linux linux kernel6.2 and later · before 6.6.33
• linux linux kernel6.7 and later · before 6.8.12
• linux linux kernel6.9 and later · before 6.9.3

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • 5.8affected
  • edf3775f0ad66879796f594983163f672c4bf1a2 and later · before 17c43211d45f13d1badea3942b76bf16bcc49281affected · git
  • edf3775f0ad66879796f594983163f672c4bf1a2 and later · before af7b560c88fb420099e29890aa682b8a3efc8784affected · git
  • edf3775f0ad66879796f594983163f672c4bf1a2 and later · before 08186d0c5fb64a1cc4b43e009314ee6b173ed222affected · git
  • edf3775f0ad66879796f594983163f672c4bf1a2 and later · before 32d988f48ed287e676a29a15ac30701c35849aecaffected · git
  • edf3775f0ad66879796f594983163f672c4bf1a2 and later · before 6593d857ce5b5b802fb73d8091ac9c84b92c1697affected · git
  • edf3775f0ad66879796f594983163f672c4bf1a2 and later · before 1a240e138071b25944ded0f5b3e357aa99fabcb7affected · git
  • edf3775f0ad66879796f594983163f672c4bf1a2 and later · before cc5645fddb0ce28492b15520306d092730dffa48affected · git
  • before 5.8not affected · semver
  • 5.10.226 and later · up to and including 5.10.*not affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2024-38575Jun 19, 2024 · wifi: brcmfmac: pcie: handle randbuf allocation failure
  22Monitor
• ← EarlierCVE-2024-38576Jun 19, 2024 · rcu: Fix buffer overflow in print_cpu_stall_info()
  28Monitor
• Later →CVE-2024-38580Jun 19, 2024 · epoll: be better about file lifetimes
  18Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.