PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-25739 Linux CVE debrief

CVE-2024-25739 affects the Linux kernel’s UBI code path in drivers/mtd/ubi/vtbl.c. The issue is a missing check for ubi->leb_size in create_empty_lvol, which can lead to an attempt to allocate zero bytes and crash the kernel. The CVE was published on 2024-02-12 and the record was later modified on 2026-05-12.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2024-04-09
Original CVE updated
2026-05-14
Advisory published
2024-04-09
Advisory updated
2026-05-14

Who should care

Linux kernel maintainers, distro security teams, and operators of systems that use the UBI/MTD storage stack should review this issue. Embedded and storage-focused deployments are the most relevant audience because the vulnerable code is in the UBI volume table path.

Technical summary

The CVE record states that create_empty_lvol in drivers/mtd/ubi/vtbl.c can attempt to allocate zero bytes because ubi->leb_size is not checked. The resulting failure mode is a crash, so the primary impact is availability rather than confidentiality or integrity. NVD classifies the issue as CVSS 3.1 5.5 MEDIUM with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H and CWE-754.

Defensive priority

Medium priority. The issue is a local availability problem in kernel code, but it affects core storage functionality and can crash the system when the vulnerable path is reached.

Recommended defensive actions

  • Apply the upstream or stable Linux kernel fix referenced in the CVE record.
  • Prioritize upgrades on systems that use UBI/MTD, especially embedded or appliance-style deployments.
  • Review downstream vendor advisories and backport status for affected kernel branches.
  • Validate that your deployed kernel is newer than the vulnerable range ending at 6.7.4.
  • Monitor for unexpected kernel crashes in environments that exercise UBI volume creation paths.

Evidence notes

This debrief is based on the CVE description and the official references listed in the record, including the upstream Linux commit, a stable branch commit, a syzkaller discussion, Debian LTS notices, a kernel mailing list post, and a Siemens CERT advisory. No exploit method or unsupported impact claims are included.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-25739 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-25739

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-25739 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-25739

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.