High 7.8Published Aug 17, 2024

CVE-2024-42276nvme-pci: add missing condition check for existence of mapped data

Updated under an hour ago (Oct 27, 2026, 12:10 AM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: add missing condition check for existence of mapped data nvme_map_data() is called when request has physical segments, hence the nvme_unmap_data() should have same condition to avoid dereference.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	4aedb705437f6f98b45f45c394e6803ca67abd33 builds before 3f8ec1d6b0ebd8268307d52be8301973fa5a01ec; from 4aedb705437f6f98b45f45c394e6803ca67abd33 before be23ae63080e0bf9e246ab20207200bca6585eba; from 4aedb705437f6f98b45f45c394e6803ca67abd33 before 7cc1f4cd90a00b6191cb8cda2d1302fdce59361c; from 4aedb705437f6f98b45f45c394e6803ca67abd33 before d135c3352f7c947a922da93c8e763ee6bc208b64; from 4aedb705437f6f98b45f45c394e6803ca67abd33 before 77848b379e9f85a08048a2c8b3b4a7e8396f5f83; from 4aedb705437f6f98b45f45c394e6803ca67abd33 before 70100fe721840bf6d8e5abd25b8bffe4d2e049b7; from 4aedb705437f6f98b45f45c394e6803ca67abd33 before c31fad1470389666ac7169fe43aa65bf5b7e2cfd	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	before V1.1.1	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.2 before 5.4.282; from 5.5 before 5.10.224; from 5.11 before 5.15.165; from 5.16 before 6.1.103; from 6.2 before 6.6.44; from 6.7 before 6.10.3	NVD

References

References

https://git.kernel.org/stable/c/3f8ec1d6b0ebd8268307d52be8301973fa5a01ec	patch
https://git.kernel.org/stable/c/be23ae63080e0bf9e246ab20207200bca6585eba	patch
https://git.kernel.org/stable/c/7cc1f4cd90a00b6191cb8cda2d1302fdce59361c	patch
https://git.kernel.org/stable/c/d135c3352f7c947a922da93c8e763ee6bc208b64	patch
https://git.kernel.org/stable/c/77848b379e9f85a08048a2c8b3b4a7e8396f5f83	patch
https://git.kernel.org/stable/c/70100fe721840bf6d8e5abd25b8bffe4d2e049b7	patch
https://git.kernel.org/stable/c/c31fad1470389666ac7169fe43aa65bf5b7e2cfd	patch
https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
https://cert-portal.siemens.com/productcert/html/ssa-265688.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.