What is the CVSS score of CVE-2024-38542?

CVE-2024-38542 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2024-38542?

A kernel memory corruption flaw in Linux systems using Microsoft Azure MANA network adapters allows local users with limited system access to compromise kernel integrity and system stability.. A patch is available.

How to fix or mitigate CVE-2024-38542?

Within 24 hours, inventory systems running the mana_ib Linux kernel driver, particularly Azure VMs configured with MANA network adapters, and assess which are production-critical. Within 7 days, obtain and test the vendor-released patch in a staging environment to confirm compatibility with your kernel version and dependent applications, then schedule patching windows for non-critical systems. Within 30 days, deploy the patched kernel to all production systems using Azure MANA adapters, prioritizing internet-facing or high-privilege workloads, and verify kernel version post-deployment to confirm successful patch application.

Linux Kernel CVE-2024-38542

HIGH

Improper Validation of Array Index (CWE-129)

2024-06-19 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Buffer Overflow Linux

7.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local kernel driver flaw exploitable by low-privilege user with no interaction; full kernel memory corruption impact warrants H/H/H; scope unchanged as no cross-VM impact identified.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 12:06 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 12:00 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 11:59 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

CVSS changed

Aug 04, 2026 - 11:23 NVD

7.1 (HIGH) 7.8 (HIGH)

CVE Published

Jun 19, 2024 - 14:15 cve.org

HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mana_ib: boundary check before installing cq callbacks

Add a boundary check inside mana_ib_install_cq_cb to prevent index overflow.

AnalysisAI

Index overflow in the Linux kernel's RDMA mana_ib driver allows a local low-privileged user to corrupt kernel memory by triggering mana_ib_install_cq_cb without a boundary check on the completion queue callback array index. The flaw (CWE-129) affects systems running the mana_ib driver - specific to Microsoft Azure MANA network adapter hardware - and carries a CVSS 7.8 with full high C/I/A impact, though real-world risk is constrained by the local-only attack vector and narrow hardware applicability. No public exploit has been identified, and EPSS at 0.25% (16th percentile) confirms low exploitation probability at time of analysis.

Technical ContextAI

The vulnerability resides in the RDMA (Remote Direct Memory Access) subsystem of the Linux kernel, specifically in the mana_ib driver, which provides InfiniBand-compatible RDMA access over Microsoft Azure's MANA (Microsoft Azure Network Adapter) hardware. CWE-129 (Improper Validation of Array Index) describes the root cause: the function mana_ib_install_cq_cb fails to verify that an index falls within valid array bounds before using it to register a completion queue (CQ) callback. An unchecked index can point to memory outside the intended array, resulting in an out-of-bounds write that corrupts adjacent kernel memory structures. Affected products per CPE cpe:2.3:o:linux:linux_kernel:* span multiple Linux kernel stable branches with no pinned version floor indicated by NVD.

RemediationAI

Apply the upstream kernel stable patches available at https://git.kernel.org/stable/c/168f6fbde0eabd71d1f4133df7d001a950b96977, https://git.kernel.org/stable/c/f12afddfb142587d786df9e3cc4862190d3e2ec8, and https://git.kernel.org/stable/c/f79edef79b6a2161f4124112f9b0c46891bb0b74; these are upstream fix commits and a specific released patched version number is not independently confirmed from available data - consult your Linux distribution's security tracker (e.g., Ubuntu USN, Red Hat RHSA, SUSE CVE) for backported packages. For systems that do not use Microsoft Azure MANA RDMA hardware, the most effective compensating control is to blacklist the mana_ib module by adding 'blacklist mana_ib' to /etc/modprobe.d/blacklist.conf and running depmod; this carries no functional penalty on non-MANA systems. On Azure VMs where MANA RDMA is in active use, unloading the module will disable RDMA functionality, so patching via a kernel update is the preferred path.