Answer in brief
CVE-2024-46743 records a Unknown severity vulnerability in of/irq: Prevent device address out-of-bounds read in interrupt map walk. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/RUGGEDCOM RST2428P (generic), Siemens/SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2024-46743 records a Unknown severity vulnerability in of/irq: Prevent device address out-of-bounds read in interrupt map walk. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/RUGGEDCOM RST2428P (generic), Siemens/SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/RUGGEDCOM RST2428P (generic), Siemens/SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08 <d2a79494d8a5262949736fb2c3ac44d20a51b0d8 || >=cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08 <defcaa426ba0bc89ffdafb799d2e50b52f74ffc4 || >=cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08 <9d1e9f0876b03d74d44513a0ed3ed15ef8f2fed5 || >=cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08 <baaf26723beab3a04da578d3008be3544f83758f || >=cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08 <8ff351ea12e918db1373b915c4c268815929cbe5 || >=cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08 <7ead730af11ee7da107f16fc77995613c58d292d || >=cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08 <bf68acd840b6a5bfd3777e0d5aaa204db6b461a9 || >=cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08 <b739dffa5d570b411d4bdf4bb9b8dfd6b7d72305 | d2a79494d8a5262949736fb2c3ac44d20a51b0d8, defcaa426ba0bc89ffdafb799d2e50b52f74ffc4, 9d1e9f0876b03d74d44513a0ed3ed15ef8f2fed5, baaf26723beab3a04da578d3008be3544f83758f, 8ff351ea12e918db1373b915c4c268815929cbe5, 7ead730af11ee7da107f16fc77995613c58d292d, bf68acd840b6a5bfd3777e0d5aaa204db6b461a9, b739dffa5d570b411d4bdf4bb9b8dfd6b7d72305 |
| Linux/Linuxgeneric | 2.6.18 | Not reported |
| Siemens/RUGGEDCOM RST2428Pgeneric | >=0 <V3.2 | V3.2 |
| Siemens/SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 familygeneric | >=0 <V3.2 | V3.2 |
| Siemens/SCALANCE XCM-/XRM-/XCH-/XRH-300 familygeneric | >=0 <V3.2 | V3.2 |
| Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.0 <V3.1.5 | V3.1.5 |
| Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPgeneric | >=V3.1.0 <V3.1.5 | V3.1.5 |
| Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystemgeneric | >=0 <* | * |
| Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.0 <V3.1.5 | V3.1.5 |
Published upstream
Sep 18, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: of/irq: Prevent device address out-of-bounds read in interrupt map walk When of_irq_parse_raw() is invoked with a device address smaller than the interrupt parent node (from #address-cells property), KASAN detects the following out-of-bounds read when populating the initial match table (dyndbg="func of_irq_parse_* +p"): OF: of_irq_parse_one: dev=/soc@0/picasso/watchdog, index=0 OF: parent=/soc@0/pci@878000000000/gpio0@17,0, intsize=2 OF: intspec=4 OF: of_irq_parse_raw: ipar=/soc@0/pci@878000000000/gpio0@17,0, size=2 OF: -> addrsize=3 ================================================================== BUG: KASAN: slab-out-of-bounds in of_irq_parse_raw+0x2b8/0x8d0 Read of size 4 at addr ffffff81beca5608 by task bash/764 CPU: 1 PID: 764 Comm: bash Tainted: G O 6.1.67-484c613561-nokia_sm_arm64 #1 Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.01-12.24.03-dirty 01/01/2023 Call trace: dump_backtrace+0xdc/0x130 show_stack+0x1c/0x30 dump_stack_lvl+0x6c/0x84 print_report+0x150/0x448 kasan_report+0x98/0x140 __asan_load4+0x78/0xa0 of_irq_parse_raw+0x2b8/0x8d0 of_irq_parse_one+0x24c/0x270 parse_interrupts+0xc0/0x120 of_fwnode_add_links+0x100/0x2d0 fw_devlink_parse_fwtree+0x64/0xc0 device_add+0xb38/0xc30 of_device_add+0x64/0x90 of_platform_device_create_pdata+0xd0/0x170 of_platform_bus_create+0x244/0x600 of_platform_notify+0x1b0/0x254 blocking_notifier_call_chain+0x9c/0xd0 __of_changeset_entry_notify+0x1b8/0x230 __of_changeset_apply_notify+0x54/0xe4 of_overlay_fdt_apply+0xc04/0xd94 ... The buggy address belongs to the object at ffffff81beca5600 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 8 bytes inside of 128-byte region [ffffff81beca5600, ffffff81beca5680) The buggy address belongs to the physical page: page:00000000230d3d03 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1beca4 head:00000000230d3d03 order:1 compound_mapcount:0 compound_pincount:0 flags: 0x8000000000010200(slab|head|zone=2) raw: 8000000000010200 0000000000000000 dead000000000122 ffffff810000c300 raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffff81beca5500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffffff81beca5600: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffffff81beca5680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5700: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ================================================================== OF: -> got it ! Prevent the out-of-bounds read by copying the device address into a buffer of sufficient size.
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/RUGGEDCOM RST2428P (generic), Siemens/SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08 <d2a79494d8a5262949736fb2c3ac44d20a51b0d8 || >=cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08 <defcaa426ba0bc89ffdafb799d2e50b52f74ffc4 || >=cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08 <9d1e9f0876b03d74d44513a0ed3ed15ef8f2fed5 || >=cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08 <baaf26723beab3a04da578d3008be3544f83758f || >=cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08 <8ff351ea12e918db1373b915c4c268815929cbe5 || >=cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08 <7ead730af11ee7da107f16fc77995613c58d292d || >=cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08 <bf68acd840b6a5bfd3777e0d5aaa204db6b461a9 || >=cc9fd71c62f542233c412b5fabc1bbe0c4d5ad08 <b739dffa5d570b411d4bdf4bb9b8dfd6b7d72305 | d2a79494d8a5262949736fb2c3ac44d20a51b0d8, defcaa426ba0bc89ffdafb799d2e50b52f74ffc4, 9d1e9f0876b03d74d44513a0ed3ed15ef8f2fed5, baaf26723beab3a04da578d3008be3544f83758f, 8ff351ea12e918db1373b915c4c268815929cbe5, 7ead730af11ee7da107f16fc77995613c58d292d, bf68acd840b6a5bfd3777e0d5aaa204db6b461a9, b739dffa5d570b411d4bdf4bb9b8dfd6b7d72305 |
| Linux/Linuxgeneric | 2.6.18 | Not reported |
| Siemens/RUGGEDCOM RST2428Pgeneric | >=0 <V3.2 | V3.2 |
| Siemens/SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 familygeneric | >=0 <V3.2 | V3.2 |
| Siemens/SCALANCE XCM-/XRM-/XCH-/XRH-300 familygeneric | >=0 <V3.2 | V3.2 |
| Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.0 <V3.1.5 | V3.1.5 |
| Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPgeneric | >=V3.1.0 <V3.1.5 | V3.1.5 |
| Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystemgeneric | >=0 <* | * |
| Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.0 <V3.1.5 | V3.1.5 |
Published upstream
Sep 18, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: of/irq: Prevent device address out-of-bounds read in interrupt map walk When of_irq_parse_raw() is invoked with a device address smaller than the interrupt parent node (from #address-cells property), KASAN detects the following out-of-bounds read when populating the initial match table (dyndbg="func of_irq_parse_* +p"): OF: of_irq_parse_one: dev=/soc@0/picasso/watchdog, index=0 OF: parent=/soc@0/pci@878000000000/gpio0@17,0, intsize=2 OF: intspec=4 OF: of_irq_parse_raw: ipar=/soc@0/pci@878000000000/gpio0@17,0, size=2 OF: -> addrsize=3 ================================================================== BUG: KASAN: slab-out-of-bounds in of_irq_parse_raw+0x2b8/0x8d0 Read of size 4 at addr ffffff81beca5608 by task bash/764 CPU: 1 PID: 764 Comm: bash Tainted: G O 6.1.67-484c613561-nokia_sm_arm64 #1 Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.01-12.24.03-dirty 01/01/2023 Call trace: dump_backtrace+0xdc/0x130 show_stack+0x1c/0x30 dump_stack_lvl+0x6c/0x84 print_report+0x150/0x448 kasan_report+0x98/0x140 __asan_load4+0x78/0xa0 of_irq_parse_raw+0x2b8/0x8d0 of_irq_parse_one+0x24c/0x270 parse_interrupts+0xc0/0x120 of_fwnode_add_links+0x100/0x2d0 fw_devlink_parse_fwtree+0x64/0xc0 device_add+0xb38/0xc30 of_device_add+0x64/0x90 of_platform_device_create_pdata+0xd0/0x170 of_platform_bus_create+0x244/0x600 of_platform_notify+0x1b0/0x254 blocking_notifier_call_chain+0x9c/0xd0 __of_changeset_entry_notify+0x1b8/0x230 __of_changeset_apply_notify+0x54/0xe4 of_overlay_fdt_apply+0xc04/0xd94 ... The buggy address belongs to the object at ffffff81beca5600 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 8 bytes inside of 128-byte region [ffffff81beca5600, ffffff81beca5680) The buggy address belongs to the physical page: page:00000000230d3d03 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1beca4 head:00000000230d3d03 order:1 compound_mapcount:0 compound_pincount:0 flags: 0x8000000000010200(slab|head|zone=2) raw: 8000000000010200 0000000000000000 dead000000000122 ffffff810000c300 raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffff81beca5500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffffff81beca5600: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffffff81beca5680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5700: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ================================================================== OF: -> got it ! Prevent the out-of-bounds read by copying the device address into a buffer of sufficient size.
Quoted source text, attributed separately from HOL analysis.