CVE-2024-50302 Linux Kernel Use of Uninitialized Resource

What is CVE-2024-50302?

CVE-2024-50302 is a medium-severity vulnerability in Debian Debian Linux, published on 19 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

HID: core: zero-initialize the report buffer

Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report.

Weakness: CWE-908

Which versions are affected by CVE-2024-50302?

It affects 5 products.

Products include Debian Debian Linux, Google Android, Linux kernel, Siemens Simatic S7-1500 Tm Mfp Firmware, Siemens Sinec Os.

How do I fix CVE-2024-50302?

Apply the vendor's patch. US federal agencies must fix it by 25 Mar 2025.

Is CVE-2024-50302 being exploited?

Yes. Attackers have exploited CVE-2024-50302 in the wild since at least 4 Mar 2025.

Other vulnerabilities in Debian Debian Linux

• CVE-2015-3306 ProFTPD Improper Access Control Exploited Critical 10.0
• CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted Data Exploited Critical 9.9
• CVE-2026-24061 GNU InetUtils Argument Injection Exploited Critical 9.8
• CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Exploited Critical 9.8
• CVE-2024-9680 Mozilla Firefox Use-After-Free Exploited Critical 9.8

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as A-380395346, ASB-A-380395346, AZL-53606, AZL-53706, BELL-CVE-2024-50302, DEBIAN-CVE-2024-50302 and 4 more.