Vulnerability record · CVE-2024-53197 · published 27 December 2024
CVE-2024-53197: Linux kernel ALSA USB-audio out-of-bounds access via bogus device
Linux · Linux Kernel
The Linux kernel ALSA USB-audio driver mishandles a device-supplied bNumConfigurations value that exceeds the allocation made by usb_get_configuration, leading to out-of-bounds accesses such as in usb_destroy_configuration. A malicious or malformed USB device can trigger memory corruption in the kernel, and the flaw is listed in CISA KEV, so it warrants prompt patching.
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configuration for allocating dev->config. This can lead to out-of-bounds accesses later, e.g. in usb_destroy_configuration.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityKernel memory corruption reachable via a malicious USB device and listed in CISA KEV, though exploitation requires local physical access.
What it is
The Linux kernel ALSA USB-audio driver mishandles a device-supplied bNumConfigurations value that exceeds the allocation made by usb_get_configuration, leading to out-of-bounds accesses such as in usb_destroy_configuration. A malicious or malformed USB device can trigger memory corruption in the kernel, and the flaw is listed in CISA KEV, so it warrants prompt patching.
Impact
An attacker who can present a crafted USB device gains kernel-level out-of-bounds read/write, which can lead to memory corruption, crash, or potentially code execution in kernel context.
Attack surface
Reached locally by plugging in a malicious or malformed USB audio device (Extigy/Mbox class); the CVSS vector is AV:L/AC:L/PR:L/UI:N, so low privileges are required and no user interaction is needed.
Exploitation
CVE-2024-53197 is in CISA KEV with a 2025-04-30 remediation due date, indicating known exploitation; EPSS 30-day probability is about 3.6% (88th percentile). No ransomware campaign use is documented.
What to do
- Apply the upstream Linux kernel patches referenced in the git.kernel.org stable commits and update to a fixed kernel version.
- For Debian, apply the fixes announced in the debian-lts-announce March 2025 advisories.
- Restrict physical USB port access and use USB device allowlisting or port controls where feasible.
- Follow CISA BOD 22-01 guidance and vendor instructions for any cloud or managed Linux instances.
- If patching is not possible, discontinue use of affected systems or isolate them from untrusted USB devices.
Detection
- Monitor kernel logs for USB-audio driver errors, out-of-bounds warnings, or crashes tied to Extigy/Mbox devices.
- Alert on unexpected USB device insertions, especially audio-class devices, on servers and sensitive endpoints.
- Track kernel versions against the fixed stable releases and flag unpatched hosts.
- Use KEV and vulnerability scanners to confirm remediation status for CVE-2024-53197.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2024-53197 to the Known Exploited Vulnerabilities catalog on 9 April 2025 as "Linux Kernel Out-of-Bounds Access Vulnerability". Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 30 April 2025.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2024-53197 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-53197), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
