CVE-2024-50302

HID: core: zero-initialize the report buffer

Medium 5.5
Exploited: added to CISA KEV 4 Mar 2025

Description

In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report.

Key facts

Published: 19 Nov 2024
Last changed: 15 Oct 2026
Assigned by: Linux
KEV added: 4 Mar 2025
KEV fix due: 25 Mar 2025
EPSS: 0.811% likely to be exploited in the next 30 days, higher than 57.494% of CVEs (scores for 15 Nov 2026)
SSVC (CISA): Exploitation: active; Automatable: no; Technical impact: partial

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

5.5CVSS 3.1, Mediumfrom CISA (ADP container)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Vendor	Product	Versions
Linux	Linux	Default status: unaffected 27ce405039bfe6d3f4143415c638f56a3df77dca up to but excluding e7ea60184e1e88a3c9e437b3265cbb6439aa7e26 (affected) 27ce405039bfe6d3f4143415c638f56a3df77dca up to but excluding 3f9e88f2672c4635960570ee9741778d4135ecf5 (affected) 27ce405039bfe6d3f4143415c638f56a3df77dca up to but excluding d7dc68d82ab3fcfc3f65322465da3d7031d4ab46 (affected) 27ce405039bfe6d3f4143415c638f56a3df77dca up to but excluding 05ade5d4337867929e7ef664e7ac8e0c734f1aaf (affected) 27ce405039bfe6d3f4143415c638f56a3df77dca up to but excluding 1884ab3d22536a5c14b17c78c2ce76d1734e8b0b (affected) 27ce405039bfe6d3f4143415c638f56a3df77dca up to but excluding 9d9f5c75c0c7f31766ec27d90f7a6ac673193191 (affected) 27ce405039bfe6d3f4143415c638f56a3df77dca up to but excluding 492015e6249fbcd42138b49de3c588d826dd9648 (affected) 27ce405039bfe6d3f4143415c638f56a3df77dca up to but excluding 177f25d1292c7e16e1199b39c85480f7f8815552 (affected) b2b6cadad699d44a8a5b2a60f3d960e00d6fb3b7 (affected) fe6c9b48ebc920ff21c10c50ab2729440c734254 (affected) 3.10.16 up to but excluding 3.11 (affected) 3.11.5 up to but excluding 3.12 (affected)
Linux	Linux	Default status: affected 3.12 (affected) 0 up to but excluding 3.12 (unaffected) 4.19.324 up to and including 4.19.* (unaffected) 5.4.286 up to and including 5.4.* (unaffected) 5.10.230 up to and including 5.10.* (unaffected) 5.15.172 up to and including 5.15.* (unaffected) 6.1.117 up to and including 6.1.* (unaffected) 6.6.61 up to and including 6.6.* (unaffected) 6.11.8 up to and including 6.11.* (unaffected) 6.12 up to and including * (unaffected)