{"cve":"CVE-2024-38556","nvd":{"published":"2024-06-19T14:15:15.810","modified":"2026-08-04T11:18:43.907","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Add a timeout to acquire the command queue semaphore\n\nPrevent forced completion handling on an entry that has not yet been\nassigned an index, causing an out of bounds access on idx = -22.\nInstead of waiting indefinitely for the sem, blocking flow now waits for\nindex to be allocated or a sem acquisition timeout before beginning the\ntimer for FW completion.\n\nKernel log example:\nmlx5_core 0000:06:00.0: wait_func_handle_exec_timeout:1128:(pid 185911): cmd[-22]: CREATE_UCTX(0xa04) No done completion","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-129"],"references":["https://git.kernel.org/stable/c/2d0962d05c93de391ce85f6e764df895f47c8918","https://git.kernel.org/stable/c/485d65e1357123a697c591a5aeb773994b247ad7","https://git.kernel.org/stable/c/4baae687a20ef2b82fde12de3c04461e6f2521d6","https://git.kernel.org/stable/c/94024332a129c6e4275569d85c0c1bfb2ae2d71b","https://git.kernel.org/stable/c/f9caccdd42e999b74303c9b0643300073ed5d319"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T21:52:00.836172422+00:00"},"epss":{"cve":"CVE-2024-38556","score":0.00259,"percentile":0.17624,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}