{
  "cveId": "CVE-2024-53092",
  "url": "https://patchblox.com/security/cve/CVE-2024-53092",
  "summary": "CVE-2024-53092 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-53092, released November 21, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  virtio_pci: Fix admin vq cleanup by using correc...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  virtio_pci: Fix admin vq cleanup by using correct info pointer  vp_modern_avq_cleanup() and vp_del_vqs() clean up admin vq resources by virtio_pci_vq_info pointer. The info pointer of admin vq is stored in vp_dev-\u003Eadmin_vq.info instead of vp_dev-\u003Evqs[]. Using the info pointer from vp_dev-\u003Evqs[] for admin vq causes a kernel NULL pointer dereference bug. In vp_modern_avq_cleanup() and vp_del_vqs(), get the info pointer from vp_dev-\u003Eadmin_vq.info for admin vq to clean up the resources. Also make info ptr as argument of vp_del_vq() to be symmetric with vp_setup_vq().  vp_reset calls vp_modern_avq_cleanup, and causes the Call Trace: ================================================================== BUG: kernel NULL pointer dereference, address:0000000000000000 ... CPU: 49 UID: 0 PID: 4439 Comm: modprobe Not tainted 6.11.0-rc5 #1 RIP: 0010:vp_reset\u002B0x57/0x90 [virtio_pci] Call Trace:  \u003CTASK\u003E ...  ? vp_reset\u002B0x57/0x90 [virtio_pci]  ? vp_reset\u002B0x38/0x90 [virtio_pci]  virtio_reset_device\u002B0x1d/0x30  remove_vq_common\u002B0x1c/0x1a0 [virtio_net]  virtnet_remove\u002B0xa1/0xc0 [virtio_net]  virtio_dev_remove\u002B0x46/0xa0 ...  virtio_pci_driver_exit\u002B0x14/0x810 [virtio_pci] ==================================================================",
  "published": "2024-11-21T19:15:12Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00203,
  "epssPercentile": 0.10369,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.11.9-1",
      "fix": "DEBIAN-CVE-2024-53092",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-53092",
      "released": "2024-11-21T19:15:12Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.11.9-1",
      "fix": "DEBIAN-CVE-2024-53092",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-53092",
      "released": "2024-11-21T19:15:12Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T13:31:49Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}