CVE-2024-57802
A vulnerability in the Linux kernel's netrom component allows for an uninitialized value read when sending raw messages through the IEEE 802.154 implementation. This occurs because the system fails to verify the buffer length before accessing it.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users running the Linux kernel, specifically versions related to the 6.13 development cycle or those utilizing the netrom and IEEE 802.154 implementations.
Real-world impact
An attacker could potentially cause system instability or information leakage by triggering an uninitialized memory read during network operations.
Why this severity
The critical score reflects that the vulnerability can be exploited remotely over a network without authentication or user interaction, potentially impacting the confidentiality and availability of the system.
What to do about it
- 01Update the Linux kernel to a version that includes the fix for the netrom buffer length check.
NVD-referenced vendor advisory
Timeline
- Jan 15, 2025 · Jan 15, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/3ba7f80d98d4965349…patch
- git.kernel.org/stable/c/64e9f54a14f2887be8…patch
- git.kernel.org/stable/c/769e36c2119a51070f…patch
- git.kernel.org/stable/c/78a110332ae268d0b0…patch
- git.kernel.org/stable/c/a4fd163aed2edd967a…patch
- git.kernel.org/stable/c/cf6befa7c569787f53…patch
- git.kernel.org/stable/c/f647d72245aadce306…patch
- lists.debian.org/debian-lts-announce/2025/03…
- lists.debian.org/debian-lts-announce/2025/03…