CVE-2024-50302: Linux kernel HID core uninitialized report buffer leaks kernel memory

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityCISA KEV listing confirms known exploitation, but the local-only vector, low privileges required and medium CVSS score keep it below critical.

What it is

The Linux kernel HID core allocates a report buffer without zero-initializing it, so residual kernel memory can be exposed through crafted HID reports. Because the buffer is shared across many HID drivers, the flaw affects a broad set of kernel configurations and can disclose sensitive kernel data.

Impact

An attacker with local access can read uninitialized kernel memory, potentially exposing pointers, keys or other sensitive data that aid further kernel exploitation. The CVSS vector rates confidentiality impact as high with no integrity or availability effect.

Attack surface

Reached locally through the HID subsystem, requiring low privileges (PR:L) and no user interaction (UI:N) per the CVSS vector. The description does not specify which HID drivers or device paths are involved.

Exploitation

CVE-2024-50302 is listed in CISA KEV with a due date of 2025-03-25, indicating known exploitation, while EPSS 30-day probability is low at 0.00811 (55th percentile). No ransomware campaign use is documented.

What to do

• Apply the upstream Linux kernel patches referenced in the git.kernel.org stable commits and update to a fixed kernel release.
• For Debian, Android and Siemens products, apply the vendor advisories (Debian LTS announcements, Siemens SSA-265688 and SSA-355557) or discontinue use if no fix is available, per CISA BOD 22-01 guidance.
• Restrict local access and HID device attachment to trusted users and physical ports where feasible.
• Monitor CISA KEV guidance and vendor bulletins for updated fixed versions covering your kernel and firmware.
• Where patching is delayed, consider disabling or limiting unused HID drivers to reduce exposure.

Detection

• Monitor kernel logs and audit trails for unusual HID device activity or repeated report handling errors.
• Track local privilege and device access events on hosts running unpatched kernels, especially around HID subsystem use.
• Use endpoint detection to flag unexpected kernel memory disclosure indicators or suspicious local HID interactions.
• Verify kernel versions against vendor fixed releases and alert on hosts still running vulnerable builds.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.