What is the CVSS score of CVE-2024-38623?

CVE-2024-38623 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Linux Kernel are affected by CVE-2024-38623?

A buffer overflow in the Linux kernel's NTFS3 filesystem driver allows local users with basic system access to corrupt kernel memory, creating risk of system crashes, data corruption, or privilege…. A patch is available.

How to fix or mitigate CVE-2024-38623?

Within 24 hours, inventory all Linux systems using NTFS3 filesystem support and identify current kernel versions against your distribution's CVE-2024-38623 security advisory. Within 7 days, apply kernel security updates from your distribution vendor (Red Hat, Ubuntu, Debian, SUSE, etc.); validate patches in non-production environment first before production deployment. For systems unable to patch immediately, disable the NTFS3 filesystem module and restrict local user account provisioning to essential personnel. Within 30 days, confirm patch deployment across all affected systems, conduct access control review to minimize low-privilege user accounts on critical infrastructure, and audit system logs for exploitation attempts.

Linux Kernel CVE-2024-38623

HIGH

Improper Validation of Array Index (CWE-129)

2024-06-21 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local attack via filesystem interaction, low-privilege user can mount NTFS; full kernel memory corruption impact across CIA.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 11:54 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 11:47 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 11:23 NVD

CRITICAL HIGH

CVSS changed

Aug 04, 2026 - 11:23 NVD

9.8 (CRITICAL) 7.8 (HIGH)

CVE Published

Jun 21, 2024 - 11:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Use variable length array instead of fixed size

Should fix smatch warning: ntfs_set_label() error: __builtin_memcpy() 'uni->name' too small (20 vs 256)

AnalysisAI

Buffer overflow in the Linux kernel's NTFS3 filesystem driver (ntfs_set_label()) allows a local attacker with low privileges to corrupt memory by triggering a memcpy of up to 256 bytes into a fixed 20-byte buffer (uni->name). The root cause is a fixed-size array declaration that does not accommodate the maximum Unicode volume-label length, identified via smatch static analysis. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; however, the CVSS 7.8 rating reflects the potential for high-impact local exploitation with full confidentiality, integrity, and availability consequences.

Technical ContextAI

The vulnerability resides in fs/ntfs3/ntfs_set_label() within the ntfs3 driver, the modern NTFS filesystem implementation merged into the mainline Linux kernel in version 5.15. The affected code path constructs a Unicode structure (uni) whose name member was statically declared with a fixed size of 20 characters. An NTFS volume label can be up to 128 Unicode characters (256 bytes), so a __builtin_memcpy() targeting uni->name with a label of non-trivial length overflows the allocation. CWE-129 (Improper Validation of Array Index) is the assigned root cause class, reflecting the failure to validate the copy length against the buffer capacity before the memcpy. The fix replaces the fixed-size array with a variable-length array (VLA) sized appropriately for the input. Affected products per CPE: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* across multiple stable branches.

RemediationAI

The primary fix is to update to a patched Linux kernel version that incorporates one of the five stable-branch commits referenced in the NVD patch references (https://git.kernel.org/stable/c/1997cdc3e727526aa5d84b32f7cbb3f56459b7ef and siblings). Upstream fixes are available as stable commits; exact released patched kernel versions per stable branch are not confirmed in the available data and should be verified against distribution advisories. As a compensating control where immediate patching is not possible, restrict the ability of unprivileged users to mount NTFS filesystems by ensuring CONFIG_NTFS3_FS is not enabled if NTFS support is not required, or by enforcing kernel namespace restrictions (e.g., kernel.unprivileged_userns_clone=0 on applicable distros) to limit the attack surface. Disabling or restricting FUSE-based NTFS mounts for unprivileged users is a lower-impact workaround that does not address the ntfs3 kernel driver directly. Distributors such as Debian, Ubuntu, and RHEL typically backport these stable fixes; check vendor-specific security trackers for confirmed patched package versions.