VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Feb 12, 2024· Updated May 12, 2026

CVE-2024-25739

CVE-2024-25739

Description

create_empty_lvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero bytes, and crash, because of a missing check for ubi->leb_size.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

The Linux kernel's UBI subsystem crashes in create_empty_lvol due to missing validation of ubi->leb_size, allowing allocation of zero bytes via vzalloc.

A denial-of-service vulnerability exists in the Linux kernel's UBI (Unsorted Block Images) subsystem, specifically in the create_empty_lvol function within drivers/mtd/ubi/vtbl.c. The flaw is that the function fails to verify that ubi->leb_size is non-zero before allocating memory using vzalloc. If a zero value is passed, the allocation request becomes zero bytes, which triggers a warning and potential kernel crash [2].

The attack vector is accessible through the /dev/ubi_ctrl device, using the UBI_IOCATT IOCTL command. An attacker can manipulate fields in the ubi_attach_req structure, such as vid_hdr_offset and max_beb_per1024, which influence the resulting leb_size. By choosing specific values, an attacker can force leb_size to zero, leading to the vulnerable allocation path [2]. No special privileges appear to be required beyond the ability to open the character device.

The impact is a system crash or denial of service (kernel panic) caused by the invalid memory allocation. The crash manifests as a warning about a zero-size vmalloc, and in many configurations results in an unrecoverable kernel state [2]. The vulnerability affects Linux kernel versions through 6.7.4, and has also been listed among CVEs affecting SIMATIC S7-1500 TM MFP GNU/Linux subsystem products by Siemens [1].

A fix has been provided in the mainline Linux kernel commit 68a24aba7c593eafa8fd00f2f76407b9b32b47a9, which adds a check for ubi->leb_size before allocation [3]. The stable kernel trees (e.g., v6.6.24) also include the backported fix in commit d1b505c988b7 [4]. Users should update to a patched kernel version or apply the patch.

References
  1. SSA-265688
  2. [Linux Kernel Bug] WARNING: zero-size vmalloc in ubi_read_volume_table
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

104

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.