High 7.8Published Dec 28, 2024

CVE-2024-56681crypto: bcm - add error check in the ahash_hmac_init function

Updated under an hour ago (Oct 28, 2026, 2:10 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: crypto: bcm - add error check in the ahash_hmac_init function The ahash_init functions may return fails. The ahash_hmac_init should not return ok when ahash_init returns error. For an example, ahash_init will return -ENOMEM when allocation memory is error.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	9d12ba86f818aa9cfe9f01b750336aa441f2ffa2 builds before 8f1a9a960b1107bd0e0ec3736055f5ed0e717edf; from 9d12ba86f818aa9cfe9f01b750336aa441f2ffa2 before 75e1e38e5d80d6d9011b7322698ffba3dd3db30a; from 9d12ba86f818aa9cfe9f01b750336aa441f2ffa2 before 28f8ffa945f7d7150463e15097ea73b19529d6f5; 9d12ba86f818aa9cfe9f01b750336aa441f2ffa2 builds before 4ea3e3b761e371102bb1486778e2f8dbc9e37413; 9d12ba86f818aa9cfe9f01b750336aa441f2ffa2 builds before 05f0a3f5477ecaa1cf46448504afe9e7c2e96fcc; from 9d12ba86f818aa9cfe9f01b750336aa441f2ffa2 before ae5253313e0ea5f00c06176074592b7f493c8546; from 9d12ba86f818aa9cfe9f01b750336aa441f2ffa2 before ee36db8e8203420e6d5c42eb9428920c2fc36532; from 9d12ba86f818aa9cfe9f01b750336aa441f2ffa2 before bba9e38c5ad41d0a88b22a59e5b6dd3e31825118; and 1 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 4.11 before 4.19.325; from 4.20 before 5.4.287; from 5.5 before 5.10.231; from 5.11 before 5.15.174; from 5.16 before 6.1.120; from 6.2 before 6.6.64; from 6.7 before 6.11.11; from 6.12 before 6.12.2	NVD

References

References

https://git.kernel.org/stable/c/8f1a9a960b1107bd0e0ec3736055f5ed0e717edf	patch
https://git.kernel.org/stable/c/75e1e38e5d80d6d9011b7322698ffba3dd3db30a	patch
https://git.kernel.org/stable/c/28f8ffa945f7d7150463e15097ea73b19529d6f5	patch
https://git.kernel.org/stable/c/4ea3e3b761e371102bb1486778e2f8dbc9e37413	patch
https://git.kernel.org/stable/c/05f0a3f5477ecaa1cf46448504afe9e7c2e96fcc	patch
https://git.kernel.org/stable/c/ae5253313e0ea5f00c06176074592b7f493c8546	patch
https://git.kernel.org/stable/c/ee36db8e8203420e6d5c42eb9428920c2fc36532	patch
https://git.kernel.org/stable/c/bba9e38c5ad41d0a88b22a59e5b6dd3e31825118	patch
https://git.kernel.org/stable/c/19630cf57233e845b6ac57c9c969a4888925467b	patch
https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.