# CVE-2024-23307: Linux Kernel integer overflow in raid5_cache_count

Source: https://junglewise.ai/threats/cve-2024-23307-linux-kernel-integer-overflow-in-raid5-cache-count  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-01-25. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2024-23307 · Severity: medium · CVSS 4.4 · Published 2024-01-25

A vulnerability exists in the Linux kernel's RAID storage management system, which is used to manage multiple hard drives for data redundancy and performance. An attacker could exploit this flaw to cause a system crash or potentially gain unauthorized access to data. This affects various Linux-based systems, including industrial automation components like the Siemens SIMATIC S7-1500.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem](https://junglewise.ai/threats/technologies/simatic-s7-1500-tm-mfp-gnu-linux-subsystem). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2024-23307 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-23307 being exploited in the wild.

**How severe is CVE-2024-23307?** Medium severity, with a CVSS score of 4.4, published 25 January 2024.

**Which products and versions are affected?** Linux Kernel 4.1 to 6.7.2; 6.1.84; 6.6.24; 6.7.12; 6.8.3; Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem All versions.

**Is there a fix for CVE-2024-23307?** A patch was published on 2024-01-12: Patch submitted to Linux RAID mailing list Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-23307 attacked?** It is attacked with local access or over the network, in an operating system.

**Am I affected by CVE-2024-23307?** Check whether you run Linux Kernel or Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow or wraparound vulnerability exists in the raid5_cache_count() function within the Linux kernel's md/raid5 modules. The root cause is a race condition between raid5_cache_count() and raid5_set_cache_size(), where concurrent execution can lead to inconsistent reads of 'max_nr_stripes' and 'min_nr_stripes'. If 'min_nr_stripes' exceeds 'max_nr_stripes' due to an intermediate update, the subtraction results in an overflow. While some sources categorize this as requiring high privileges over a network, NIST identifies it as a local vector (AV:L) with high impact on confidentiality, integrity, and availability. Patches have been released for various kernel branches including 6.1.84, 6.6.24, 6.7.12, and 6.8.3.

## Affected products

- Linux Linux Kernel 4.1 to 6.7.2; 6.1.84; 6.6.24; 6.7.12; 6.8.3
- Siemens SIMATIC S7-1500 TM MFP GNU/Linux subsystem All versions

## Timeline

- 2024-01-12: patched: Patch submitted to Linux RAID mailing list
- 2024-01-25: disclosed: Initial CVE publication
- 2024-04-09: advisory: Siemens published advisory SSA-265688 including this CVE

## References

- [https://bugzilla.openanolis.cn/show_bug.cgi?id=7975](https://bugzilla.openanolis.cn/show_bug.cgi?id=7975)
- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)