Medium 5.5Published Jun 20, 2024

CVE-2024-38619usb-storage: alauda: Check whether the media is initialized

Updated under an hour ago (Oct 28, 2026, 12:00 AM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Check whether the media is initialized The member "uzonesize" of struct alauda_info will remain 0 if alauda_init_media() fails, potentially causing divide errors in alauda_read_data() and alauda_write_lba(). - Add a member "media_initialized" to struct alauda_info. - Change a condition in alauda_check_media() to ensure the first initialization. - Add an error check for the return value of alauda_init_media().

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from e80b0fade09ef1ee67b0898d480d4c588f124d5f before e0aab7b07a9375337847c9d74a5ec044071e01c8; from e80b0fade09ef1ee67b0898d480d4c588f124d5f before 51fe16c058acb22f847e69bc598066ed0bcd5c15; from e80b0fade09ef1ee67b0898d480d4c588f124d5f before f68820f1256b21466ff094dd97f243b7e708f9c1; from e80b0fade09ef1ee67b0898d480d4c588f124d5f before 3eee13ab67f65606faa66e0c3c729e4f514838fd; from e80b0fade09ef1ee67b0898d480d4c588f124d5f before e0e2eec76920a133dd49a4fbe4656d83596a1361; from e80b0fade09ef1ee67b0898d480d4c588f124d5f before 2cc32639ec347e3365075b130f9953ef16cb13f1; from e80b0fade09ef1ee67b0898d480d4c588f124d5f before 24bff7f714bdff97c2a75a0ff6a368cdf8ad5af4; from e80b0fade09ef1ee67b0898d480d4c588f124d5f before 16637fea001ab3c8df528a8995b3211906165a30	CNA record
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name)	before V3.1	CISA ADP
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family siemens:scalance_xc_300_xr_300_xc_400_xr_500wg_xr_500_family (from the name)	all versions not affected	CISA ADP
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family siemens:scalance_xcm_xrm_xch_xrh_300_family (from the name)	before V3.1	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	before V1.1.1	CISA ADP
linux linux_kernel linux:linux_kernel	from 2.6.16 before 4.19.317; from 4.20 before 5.4.279; from 5.5 before 5.10.221; from 5.11 before 5.15.162; from 5.16 before 6.1.95; from 6.2 before 6.6.35; from 6.7 before 6.9.6; 6.10; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/e0aab7b07a9375337847c9d74a5ec044071e01c8	patch
https://git.kernel.org/stable/c/51fe16c058acb22f847e69bc598066ed0bcd5c15	patch
https://git.kernel.org/stable/c/f68820f1256b21466ff094dd97f243b7e708f9c1	patch
https://git.kernel.org/stable/c/3eee13ab67f65606faa66e0c3c729e4f514838fd	patch
https://git.kernel.org/stable/c/e0e2eec76920a133dd49a4fbe4656d83596a1361	patch
https://git.kernel.org/stable/c/2cc32639ec347e3365075b130f9953ef16cb13f1	patch
https://git.kernel.org/stable/c/24bff7f714bdff97c2a75a0ff6a368cdf8ad5af4	patch
https://git.kernel.org/stable/c/16637fea001ab3c8df528a8995b3211906165a30	patch
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
https://cert-portal.siemens.com/productcert/html/ssa-265688.html
1–10 of 12

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.