---
title: "CVE-2024-53197: Linux Kernel Out-of-Bounds Access Vulnerability"
url: https://erroneo.us/security/cve/CVE-2024-53197/
description: "CVE-2024-53197 (Linux Kernel): Exploited in the wild (CISA KEV). In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix…"
type: vulnerability-record
section: "Security Digest"
date_published: 2024-12-27
date_modified: 2026-05-11
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2024-53197"
kev: true
cvss: 7.8
epss: 0.04117
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2024-53197: Linux Kernel Out-of-Bounds Access Vulnerability

**Signal:** Exploited: patch now if you run it. CISA has confirmed exploitation in the wild. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Yes, if you run Linux Kernel. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2025-04-09, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2025-04-30 ; treat that as the outer limit, not the target.
- EPSS 4.1% , percentile 91: FIRST’s model estimates a 4.1% chance of exploitation activity in the next 30 days, higher than 91% of all scored CVEs (elevated). EPSS is a probability, not a verdict.
- Needs local access needed. Lower urgency for most teams unless an attacker could already run code on the machine.

## What it is

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usbgetconfiguration for allocating dev->config. This can lead to out-of-bounds accesses later, e.g. in usbdestroyconfiguration.

## Affected products (CVE record)

- Linux Linux: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0b4ea4bfe16566b84645ded1403756a2dc4e0f19, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 9b8460a2a7ce478e0b625af7c56d444dc24190f7, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 62dc01c83fa71e10446ee4c31e0e3d5d1291e865, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 9887d859cd60727432a01564e8f91302d361b72b, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 920a369a9f014f10ec282fd298d0666129379f1b, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b8f8b81dabe52b413fe9e062e8a852c48dd0680d, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 379d3b9799d9da953391e973b934764f01e03960, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b521b53ac6eb04e41c03f46f7fe452e4d8e9bcca, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b909df18ce2a998afef81d58bbd1a05dc0788c40
- Linux Linux: 2.6.12

## Severity

- CISA-ADP CVSS 3.1: 7.8 `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

## Exploitation

- CISA KEV: added 2025-04-09; federal due date 2025-04-30. Known ransomware use: Unknown.
- CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CISA SSVC assessment: exploitation active , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 4.12% probability of exploitation activity in the next 30 days; percentile 91.

## Sources

- [Listed in CISA KEV notes (lore.kernel.org)](https://lore.kernel.org/linux-cve-announce/2024122725-CVE-2024-53197-6aef@gregkh/)
- [Listed in CISA KEV notes (source.android.com)](https://source.android.com/docs/security/bulletin/2025-04-01)
- [CVE.org record CVE-2024-53197](https://www.cve.org/CVERecord?id=CVE-2024-53197)
- [NVD entry CVE-2024-53197](https://nvd.nist.gov/vuln/detail/CVE-2024-53197)
- [CISA Known Exploited Vulnerabilities catalog entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-53197)
- [git.kernel.org](https://git.kernel.org/stable/c/0b4ea4bfe16566b84645ded1403756a2dc4e0f19)
- [git.kernel.org](https://git.kernel.org/stable/c/9b8460a2a7ce478e0b625af7c56d444dc24190f7)
- [git.kernel.org](https://git.kernel.org/stable/c/62dc01c83fa71e10446ee4c31e0e3d5d1291e865)
- [git.kernel.org](https://git.kernel.org/stable/c/9887d859cd60727432a01564e8f91302d361b72b)
- [git.kernel.org](https://git.kernel.org/stable/c/920a369a9f014f10ec282fd298d0666129379f1b)
- [git.kernel.org](https://git.kernel.org/stable/c/b8f8b81dabe52b413fe9e062e8a852c48dd0680d)
- [git.kernel.org](https://git.kernel.org/stable/c/379d3b9799d9da953391e973b934764f01e03960)
- [git.kernel.org](https://git.kernel.org/stable/c/b521b53ac6eb04e41c03f46f7fe452e4d8e9bcca)
- [git.kernel.org](https://git.kernel.org/stable/c/b909df18ce2a998afef81d58bbd1a05dc0788c40)
- [lists.debian.org](https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html)
- [lists.debian.org](https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html)

---
Source page: https://erroneo.us/security/cve/CVE-2024-53197/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt