boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2024-57893MEDIUM
Linux Linux — ALSA: seq: oss: Fix races at processing SysEx messages
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   H   L   N  U  H  N  H    6.3   .0016    6.1     —
AFFECTED
  Product  Versions                                    Fixed
  Linux    1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 –  —
  Linux    2.6.12 –                                    6.1.124
TIMELINE
  Jan 11  Reserved by Linux
  Jan 15  Published (CNA: Linux)
  Aug 4   RESCORED — CVE-2024-57893 (Linux). CVSS 7.8 → 6.3 (NVD).
CWE-362 · CNA: Linux · CVSS v3.1 · 5 references · NVD status: Modified

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix races at processing SysEx messages OSS sequencer handles the SysEx messages split in 6 bytes packets, and ALSA sequencer OSS layer tries to combine those. It stores the data in the internal buffer and this access is racy as of now, which may lead to the out-of-bounds access. As a temporary band-aid fix, introduce a mutex for serializing the process of the SysEx message packets.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
January 11, 2025ReservedReserved by Linux
January 15, 2025PublishedPublished (CNA: Linux)
August 4, 2026RESCOREDRESCORED — CVE-2024-57893 (Linux). CVSS 7.8 → 6.3 (NVD).

Affected

Affected products and packages — 2 rows
VendorProduct / PackageEcosystemVersion introducedFixed
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
LinuxLinux2.6.126.1.124

Weaknesses

CWE-362

References (5)

Related

Authoritative record: CVE-2024-57893 at cve.org

Vendors: linux

Weaknesses: CWE-362

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-57893 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.