CVE-2024-58006
A critical flaw in the Linux kernel’s designware‑ep PCI endpoint driver lets an attacker change a device’s Base Address Register (BAR) size or flags without proper checks, potentially exposing memory outside the intended range. The issue has been fixed in a recent kernel commit.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users running versions that include the designware‑ep PCI endpoint driver, before the patch was applied.
Real-world impact
An attacker could read memory beyond the device’s BAR, potentially leaking sensitive data or destabilizing the system.
Why this severity
The CVSS score of 9.6 reflects the vulnerability’s high impact on confidentiality, integrity, and availability, and its ability to be exploited remotely without authentication or user interaction.
What to do about it
- 01Update the Linux kernel to a version that includes the fix for CVE-2024-58006.
- 02Restart the system to load the updated kernel.
NVD-referenced vendor advisory
Timeline
- Feb 27, 2025 · Feb 27, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 1d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.