CASCACascade Atlas

Evidence dossier

CVE-2024-53104

media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format

63.1–78.1Priority evidence range
As known Jul 19, 2026, 5:00 AM UTCgen-56ccdaf9

Normalized restatement

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming.

State
PUBLISHED
Published
Dec 2, 2024
Updated
May 11, 2026
Evidence coverage
85%
CISA KEVCatalog member

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

FIRST EPSS3.30%

2026-07-18 · v2026.06.15 · percentile 87.1%

Source stateNo scored conflict

Distinct CVSS assessments remain side by side; none are averaged.

Source comparison

Who said what

CISA-ADPindependent enrichment
container

CISA ADP Vulnrichment

CVEderivative copy
container

CVE Program Container

Linuxoriginal assertion
container

media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format

CISA KEVoriginal assertion
observed_exploitation

Linux Kernel Out-of-Bounds Write Vulnerability

FIRST EPSSoriginal assertion
model_probability

Probability 0.033010000000; percentile 0.871480000000

Applicability

Cited product scope

Trace impact →
LinuxLinux
[{"status": "affected", "version": "c0efd232929c2cd87238de2cccdaf4e845be5b0c", "lessThan": "95edf13a48e75dc2cc5b0bc57bf90d6948a22fe8", "versionType": "git"}, {"status": "affected", "version": "c0efd232929c2cd87238de2cccdaf4e845be5b0c", "lessThan": "684022f81f128338fe3587ec967459669a1204ae", "versionType": "git"}, {"status": "affected", "version": "c0efd232929c2cd87238de2cccdaf4e845be5b0c", "lessThan": "faff5bbb2762c44ec7426037b3000e77a11d6773", "versionType": "git"}, {"status": "affected", "version": "c0efd232929c2cd87238de2cccdaf4e845be5b0c", "lessThan": "467d84dc78c9abf6b217ada22b3fdba336262e29", "versionType": "git"}, {"status": "affected", "version": "c0efd232929c2cd87238de2cccdaf4e845be5b0c", "lessThan": "beced2cb09b58c1243733f374c560a55382003d6", "versionType": "git"}, {"status": "affected", "version": "c0efd232929c2cd87238de2cccdaf4e845be5b0c", "lessThan": "575a562f7a3ec2d54ff77ab6810e3fbceef2a91d", "versionType": "git"}, {"status": "affected", "version": "c0efd232929c2cd87238de2cccdaf4e845be5b0c", "lessThan": "622ad10aae5f5e03b7927ea95f7f32812f692bb5", "versionType": "git"}, {"status": "affected", "version": "c0efd232929c2cd87238de2cccdaf4e845be5b0c", "lessThan": "1ee9d9122801eb688783acd07791f2906b87cb4f", "versionType": "git"}, {"status": "affected", "version": "c0efd232929c2cd87238de2cccdaf4e845be5b0c", "lessThan": "ecf2b43018da9579842c774b7f35dbe11b5c38dd", "versionType": "git"}]unknown
LinuxLinux
[{"status": "affected", "version": "2.6.26"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.26", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.324", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.286", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.230", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.172", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.117", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.61", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.11.8", "versionType": "semver", "lessThanOrEqual": "6.11.*"}, {"status": "unaffected", "version": "6.12.1", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}]unknown
Unknown vendorUnknown product
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; start including 2.6.26; end excluding 4.19.324supported
Unknown vendorUnknown product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; start including 4.20; end excluding 5.4.286supported
Unknown vendorUnknown product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; start including 5.5; end excluding 5.10.230supported
Unknown vendorUnknown product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; start including 5.11; end excluding 5.15.172supported
Unknown vendorUnknown product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; start including 5.16; end excluding 6.1.117supported
Unknown vendorUnknown product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; start including 6.2; end excluding 6.6.61supported
Unknown vendorUnknown product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; start including 6.7; end excluding 6.11.8supported
Unknown vendorUnknown product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*; start including 6.12; end excluding 6.12.1supported

Assessments

CVSS by origin

7.8
nvd@nist.govCVSS 3.1 · role PrimaryCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8
134c704f-9b21-4f2e-91b3-4a467353bcc0CVSS 3.1 · role SecondaryCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8
CISA-ADPCVSS 3.1 · role unknownCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Limitations and unknowns

  • KEV membership is authoritative for the catalog, not proof of exposure in any environment.
  • EPSS is a dated model probability and not an individual-environment prediction.
  • Affected or fixed status applies only to the exact cited product and version scope; unresolved scope remains unknown.
  • NVD-carried upstream facts remain derivative and are not independent corroboration.
  • Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
  • NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
  • Factor D is unknown in Public Core because no accepted canonical mapping-obligation ledger is present.
  • Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.