VYPR
← All advisories
Unrated severityNVD Advisory· Published Jul 12, 2024· Updated Nov 3, 2025

vmci: prevent speculation leaks by sanitizing event in event_deliver()

CVE-2024-39499

Description

In the Linux kernel, the following vulnerability has been resolved:

vmci: prevent speculation leaks by sanitizing event in event_deliver()

Coverity spotted that event_msg is controlled by user-space, event_msg->event_data.event is passed to event_deliver() and used as an index without sanitization.

This change ensures that the event index is sanitized to mitigate any possibility of speculative information leaks.

This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc.

Only compile tested, no access to HW.

Affected products

157

Patches

8
58730dfbd4ae
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
95ac3e773a1f
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
f70ff7373467
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
681967c4ff21
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
8003f00d8953
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
757804e1c599
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
e293c6b38ac9
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
95bac1c8bedb
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.