Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2024-27059
Linux Linux — USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
AV AC PR UI S C I A CVSS EPSS %ile KEV
L L L N U N N H 5.5 .0024 14.3 —
AFFECTED
Product Versions Fixed
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – —
Linux 2.6.12 – 4.19.312
TIMELINE
Feb 19 Reserved by Linux
May 1 Published (CNA: Linux)
Oct 15 ENRICHED — CVE-2024-27059 (Linux). Received CVSS 5.5 and CPE data from NVD.
Description
In the Linux kernel, the following vulnerability has been resolved:
USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values
in the ATA ID information to calculate cylinder and head values when
creating a CDB for READ or WRITE commands. The calculation involves
division and modulus operations, which will cause a crash if either of
these values is 0. While this never happens with a genuine device, it
could happen with a flawed or subversive emulation, as reported by the
syzbot fuzzer.
Protect against this possibility by refusing to bind to the device if
either the ATA_ID_HEADS or ATA_ID_SECTORS value in the device's ID
information is 0. This requires isd200_Initialization() to return a
negative error code when initialization fails; currently it always
returns 0 (even when there is an error).
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| February 19, 2024 | Reserved | Reserved by Linux |
| May 1, 2024 | Published | Published (CNA: Linux) |
| October 15, 2026 | ENRICHED | ENRICHED — CVE-2024-27059 (Linux). Received CVSS 5.5 and CPE data from NVD. |
Affected
Affected products and packages — 2 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Linux | Linux | — | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | — |
| Linux | Linux | — | 2.6.12 | 4.19.312 |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-27059 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
