VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Aug 17, 2024· Updated May 12, 2026

CVE-2024-42276

CVE-2024-42276

Description

In the Linux kernel, the following vulnerability has been resolved:

nvme-pci: add missing condition check for existence of mapped data

nvme_map_data() is called when request has physical segments, hence the nvme_unmap_data() should have same condition to avoid dereference.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel, nvme_unmap_data() could dereference a null pointer when called without mapped data due to a missing condition check.

Vulnerability

Overview

CVE-2024-42276 is a medium-severity vulnerability (CVSS v3: 5.5) in the Linux kernel's nvme-pci driver, affecting all versions of the SIMATIC S7-1500 TM MFP - GNU/Linux subsystem [1]. The issue arises from a missing condition check in the nvme_unmap_data() function: nvme_map_data() is only invoked when a request has physical segments, but nvme_unmap_data() could be called without that prerequisite, leading to a potential null pointer dereference [1][2].

Exploitation

Scenario

To exploit this vulnerability, an attacker would need the ability to trigger an I/O request that passes through the NVMe driver without physically mapped data, causing the driver to call nvme_unmap_data() on an unmapped request. This typically requires local access to the system and the ability to issue specific NVMe commands that bypass the normal mapping check. The vulnerability is present in kernel versions prior to the fix commit [3].

Impact

A successful exploitation could result in a denial of service (DoS) due to a system crash or kernel panic when the driver dereferences a null pointer. The CVSS score of 5.5 reflects a medium impact, primarily affecting availability without compromising confidentiality or integrity [1].

Mitigation

The fix was applied in the Linux kernel stable tree with commit c31fad147038 [3]. Siemens advisory SSA-265688 confirms the vulnerability affects SIMATIC S7-1500 TM MFP devices running affected Linux kernel versions and recommends updating to patched kernel releases [1]. Users should apply the latest kernel updates from their distribution vendor.

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

98

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

10

News mentions

0

No linked articles in our index yet.