CVE-2024-53197

CVE-2024-53197 is an out-of-bounds access/write (CWE-787) in the Linux kernel's USB configuration handling, tied to the ALSA usb-audio driver's handling of Creative Extigy and Mbox devices. A malicious or bogus USB device that reports a bNumConfigurations value larger than the array allocated by usb_get_configuration causes the kernel to access memory beyond the end of dev->config, for example in usb_destroy_configuration. An attacker with local access — or the ability to plug a crafted USB audio device into a target — could corrupt or disclose kernel memory, with high impact to confidentiality, integrity, and availability (CVSS 7.8, local vector), typically as privilege escalation or a kernel crash. Any Linux deployment running a kernel with the vulnerable code is affected, including Debian systems. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-04-09, indicating known exploitation in the wild, though no public proof-of-concept is known and ransomware use is unconfirmed.

What to do: Update the Linux kernel to a vendor release containing the CVE-2024-53197 fix — for Debian, install the current kernel security update and reboot; other distributions ship the patched kernel in their stable updates. Because exploitation requires a malicious USB audio device, restrict use of untrusted USB peripherals on sensitive or internet-adjacent hosts. Organizations subject to CISA BOD 22-01 must remediate this KEV-listed flaw per the required actions or discontinue use where mitigations are unavailable.