{"cve":"CVE-2024-44969","nvd":{"published":"2024-09-04T19:15:31.240","modified":"2026-06-17T07:53:19.783","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/sclp: Prevent release of buffer in I/O\n\nWhen a task waiting for completion of a Store Data operation is\ninterrupted, an attempt is made to halt this operation. If this attempt\nfails due to a hardware or firmware problem, there is a chance that the\nSCLP facility might store data into buffers referenced by the original\noperation at a later time.\n\nHandle this situation by not releasing the referenced data buffers if\nthe halt attempt fails. For current use cases, this might result in a\nleak of few pages of memory in case of a rare hardware/firmware\nmalfunction.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":["CWE-401"],"references":["https://git.kernel.org/stable/c/1e8b7fb427af6b2ddd54eff66a6b428a81c96633","https://git.kernel.org/stable/c/1ec5ea9e25f582fd6999393e2f2c3bf56f234e05","https://git.kernel.org/stable/c/2429ea3b4330e3653b72b210a0d5f2a717359506","https://git.kernel.org/stable/c/46f67233b011385d53cf14d272431755de3a7c79","https://git.kernel.org/stable/c/7a7e60ed23d471a07dbbe72565d2992ee8244bbe"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T21:54:16.205165117+00:00"},"epss":{"cve":"CVE-2024-44969","score":0.0022,"percentile":0.1254,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}