# team: prevent adding a device which is already a team device lower

CVE record · `CVE-2024-58071`

- **Identifiers:** `CVE-2024-58071`
- **State:** Confirmed
- **Severity:** CVSS 5.5 Medium
- **Critical:** No
- **CNA:** Linux
- **Weakness (CWE):** [CWE-667](https://cwe.mitre.org/data/definitions/667.html)
- **Tags:** [CWE-667](https://agentprime.io/advisories/tag/cwe-667.md)
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 6 Mar 2025
- **Updated:** 15 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 6 Mar 2025, 15:54 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 to before 0a7794b9ca78c8e7d001c583bf05736169de3f20` (git)
  - affected: `3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 to before 62ff1615815d565448c37cb8a7a2a076492ec471` (git)
  - affected: `3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 to before bd099a2fa9be983ba0e90a57a59484fe9d520ba8` (git)
  - affected: `3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 to before adff6ac889e16d97abd1e4543f533221127e978a` (git)
  - affected: `3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 to before 184a564e6000b41582f160a5be9a9b5aabe22ac1` (git)
  - affected: `3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 to before 1bb06f919fa5bec77ad9b6002525c3dcc5c1fd6c` (git)
  - affected: `3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 to before d9bce1310c0e2a55888e3e08c9f69d8377b3a377` (git)
  - affected: `3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 to before 3fff5da4ca2164bb4d0f1e6cd33f6eb8a0e73e50` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `3.3`
  - unaffected: `before 3.3` (semver)
  - unaffected: `5.4.291 to 5.4.*, inclusive` (semver)
  - unaffected: `5.10.235 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.179 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.129 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.76 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.13 to 6.12.*, inclusive` (semver)
  - unaffected: `6.13.2 to 6.13.*, inclusive` (semver)
  - unaffected: `6.14 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 5.5 Medium, CVSS 3.1: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`, from ADP (CISA-ADP)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0018, the 7th percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 6 Mar 2025. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2024-58071](https://www.cve.org/CVERecord?id=CVE-2024-58071)
- [NVD: CVE-2024-58071](https://nvd.nist.gov/vuln/detail/CVE-2024-58071)

### References from the CNA

- <https://git.kernel.org/stable/c/0a7794b9ca78c8e7d001c583bf05736169de3f20>
- <https://git.kernel.org/stable/c/62ff1615815d565448c37cb8a7a2a076492ec471>
- <https://git.kernel.org/stable/c/bd099a2fa9be983ba0e90a57a59484fe9d520ba8>
- <https://git.kernel.org/stable/c/adff6ac889e16d97abd1e4543f533221127e978a>
- <https://git.kernel.org/stable/c/184a564e6000b41582f160a5be9a9b5aabe22ac1>
- <https://git.kernel.org/stable/c/1bb06f919fa5bec77ad9b6002525c3dcc5c1fd6c>
- <https://git.kernel.org/stable/c/d9bce1310c0e2a55888e3e08c9f69d8377b3a377>
- <https://git.kernel.org/stable/c/3fff5da4ca2164bb4d0f1e6cd33f6eb8a0e73e50>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2024-58071>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2024-58071/>. Everything for agents: <https://agentprime.io/llms.txt>.