Answer in brief
CVE-2024-42236 records a Unknown severity vulnerability in usb: gadget: configfs: Prevent OOB read/write in usb_string_copy(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2024-42236 records a Unknown severity vulnerability in usb: gadget: configfs: Prevent OOB read/write in usb_string_copy(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=88af8bbe4ef781031ad3370847553f3b42ba0076 <a444c3fc264119801575ab086e03fb4952f23fd0 || >=88af8bbe4ef781031ad3370847553f3b42ba0076 <c95fbdde87e39e5e0ae27f28bf6711edfb985caa || >=88af8bbe4ef781031ad3370847553f3b42ba0076 <e8474a10c535e6a2024c3b06e37e4a3a23beb490 || >=88af8bbe4ef781031ad3370847553f3b42ba0076 <72b8ee0d9826e8ed00e0bdfce3e46b98419b37ce || >=88af8bbe4ef781031ad3370847553f3b42ba0076 <2d16f63d8030903e5031853e79d731ee5d474e70 || >=88af8bbe4ef781031ad3370847553f3b42ba0076 <d1205033e912f9332c1dbefa812e6ceb0575ce0a || >=88af8bbe4ef781031ad3370847553f3b42ba0076 <eecfefad0953b2f31aaefa058f7f348ff39c4bba || >=88af8bbe4ef781031ad3370847553f3b42ba0076 <6d3c721e686ea6c59e18289b400cc95c76e927e0 | a444c3fc264119801575ab086e03fb4952f23fd0, c95fbdde87e39e5e0ae27f28bf6711edfb985caa, e8474a10c535e6a2024c3b06e37e4a3a23beb490, 72b8ee0d9826e8ed00e0bdfce3e46b98419b37ce, 2d16f63d8030903e5031853e79d731ee5d474e70, d1205033e912f9332c1dbefa812e6ceb0575ce0a, eecfefad0953b2f31aaefa058f7f348ff39c4bba, 6d3c721e686ea6c59e18289b400cc95c76e927e0 |
| Linux/Linuxgeneric | 3.10 | Not reported |
Published upstream
Aug 7, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read in the form `if (str[0 - 1] == '\n') followed closely by an OOB write in the form `str[0 - 1] = '\0'`. There is already a validating check to catch strings that are too long. Let's supply an additional check for invalid strings that are too short.
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=88af8bbe4ef781031ad3370847553f3b42ba0076 <a444c3fc264119801575ab086e03fb4952f23fd0 || >=88af8bbe4ef781031ad3370847553f3b42ba0076 <c95fbdde87e39e5e0ae27f28bf6711edfb985caa || >=88af8bbe4ef781031ad3370847553f3b42ba0076 <e8474a10c535e6a2024c3b06e37e4a3a23beb490 || >=88af8bbe4ef781031ad3370847553f3b42ba0076 <72b8ee0d9826e8ed00e0bdfce3e46b98419b37ce || >=88af8bbe4ef781031ad3370847553f3b42ba0076 <2d16f63d8030903e5031853e79d731ee5d474e70 || >=88af8bbe4ef781031ad3370847553f3b42ba0076 <d1205033e912f9332c1dbefa812e6ceb0575ce0a || >=88af8bbe4ef781031ad3370847553f3b42ba0076 <eecfefad0953b2f31aaefa058f7f348ff39c4bba || >=88af8bbe4ef781031ad3370847553f3b42ba0076 <6d3c721e686ea6c59e18289b400cc95c76e927e0 | a444c3fc264119801575ab086e03fb4952f23fd0, c95fbdde87e39e5e0ae27f28bf6711edfb985caa, e8474a10c535e6a2024c3b06e37e4a3a23beb490, 72b8ee0d9826e8ed00e0bdfce3e46b98419b37ce, 2d16f63d8030903e5031853e79d731ee5d474e70, d1205033e912f9332c1dbefa812e6ceb0575ce0a, eecfefad0953b2f31aaefa058f7f348ff39c4bba, 6d3c721e686ea6c59e18289b400cc95c76e927e0 |
| Linux/Linuxgeneric | 3.10 | Not reported |
Published upstream
Aug 7, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read in the form `if (str[0 - 1] == '\n') followed closely by an OOB write in the form `str[0 - 1] = '\0'`. There is already a validating check to catch strings that are too long. Let's supply an additional check for invalid strings that are too short.
Quoted source text, attributed separately from HOL analysis.