CVE-2024-43859: Linux Kernel Denial of Service Vulnerability Due to Uninitialized Data
Summary
CVE-2024-43859: In multiple locations, there is a possible persistent denial of service due to uninitialized data. Affects :linux_kernel: versions >= :0, < :2026-03-05. Fixed in :2026-03-05. How to fix ↓
Also tracked for
- linux · Debian:12
The same CVE-2024-43859 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Android operating system, responsible for managing hardware resources and providing essential services to applications. It is known for its robustness and flexibility, enabling a wide range of devices to operate efficiently. However, vulnerabilities can arise, such as the one identified in CVE-2024-43859, which exposes the kernel to potential denial of service attacks.
Vulnerability Detail
CVE-2024-43859 is a critical vulnerability found in multiple locations within the Linux kernel for Android. It stems from the use of uninitialized data, which can lead to a persistent denial of service. This vulnerability allows an attacker to exploit the system remotely without requiring any additional execution privileges or user interaction. The implications of this vulnerability are severe, as it can render the affected system unresponsive, impacting the availability of services and applications relying on the kernel.
How To Fix
Minimum fixed version
:2026-03-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as they are released.
Conclusion
CVE-2024-43859 represents a significant risk to the Linux kernel in Android, allowing for remote denial of service attacks due to uninitialized data. Users are strongly encouraged to update their systems to the patched versions to protect against potential exploitation.
See every vulnerability recorded for :linux_kernel: →
FAQ
CVE-2024-43859 is a critical vulnerability in the Linux kernel for Android that can lead to a persistent denial of service due to uninitialized data.
An attacker can exploit this vulnerability remotely without needing additional execution privileges or user interaction, potentially causing the system to become unresponsive.
The primary consequence is a denial of service, which can disrupt the availability of services and applications relying on the affected kernel.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground at Vulert Scanner without needing to sign up.
While there are no specific workarounds available, it is crucial to prioritize updating your kernel to the patched version as soon as possible to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for :linux_kernel:.
