CVE-2024-26838 (GCVE-0-2024-26838)
Vulnerability from cvelistv5
Published
2024-04-17 10:10
Modified
2026-08-05 11:27
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix KASAN issue with tasklet KASAN testing revealed the following issue assocated with freeing an IRQ. [50006.466686] Call Trace: [50006.466691] <IRQ> [50006.489538] dump_stack+0x5c/0x80 [50006.493475] print_address_description.constprop.6+0x1a/0x150 [50006.499872] ? irdma_sc_process_ceq+0x483/0x790 [irdma] [50006.505742] ? irdma_sc_process_ceq+0x483/0x790 [irdma] [50006.511644] kasan_report.cold.11+0x7f/0x118 [50006.516572] ? irdma_sc_process_ceq+0x483/0x790 [irdma] [50006.522473] irdma_sc_process_ceq+0x483/0x790 [irdma] [50006.528232] irdma_process_ceq+0xb2/0x400 [irdma] [50006.533601] ? irdma_hw_flush_wqes_callback+0x370/0x370 [irdma] [50006.540298] irdma_ceq_dpc+0x44/0x100 [irdma] [50006.545306] tasklet_action_common.isra.14+0x148/0x2c0 [50006.551096] __do_softirq+0x1d0/0xaf8 [50006.555396] irq_exit_rcu+0x219/0x260 [50006.559670] irq_exit+0xa/0x20 [50006.563320] smp_apic_timer_interrupt+0x1bf/0x690 [50006.568645] apic_timer_interrupt+0xf/0x20 [50006.573341] </IRQ> The issue is that a tasklet could be pending on another core racing the delete of the irq. Fix by insuring any scheduled tasklet is killed after deleting the irq.
References
Impacted products
Vendor Product Version
Linux Linux Version: 44d9e52977a1b90b0db1c7f8b197c218e9226520
Version: 44d9e52977a1b90b0db1c7f8b197c218e9226520
Version: 44d9e52977a1b90b0db1c7f8b197c218e9226520
Version: 44d9e52977a1b90b0db1c7f8b197c218e9226520
Version: 44d9e52977a1b90b0db1c7f8b197c218e9226520
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26838",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-10T14:27:19.140994Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:48:36.256Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.672Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/635d79aa477f9912e602feb5498bdd51fb9cb824"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b2e4a5266e3d133b4c7f0e43bf40d13ce14fd1aa"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c6f1ca235f68b22b3e691b2ea87ac285e5946848"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0ae8ad0013978f7471f22bcf45b027393e87f5dc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bd97cea7b18a0a553773af806dfbfac27a7c4acb"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/irdma/hw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "635d79aa477f9912e602feb5498bdd51fb9cb824",
              "status": "affected",
              "version": "44d9e52977a1b90b0db1c7f8b197c218e9226520",
              "versionType": "git"
            },
            {
              "lessThan": "b2e4a5266e3d133b4c7f0e43bf40d13ce14fd1aa",
              "status": "affected",
              "version": "44d9e52977a1b90b0db1c7f8b197c218e9226520",
              "versionType": "git"
            },
            {
              "lessThan": "c6f1ca235f68b22b3e691b2ea87ac285e5946848",
              "status": "affected",
              "version": "44d9e52977a1b90b0db1c7f8b197c218e9226520",
              "versionType": "git"
            },
            {
              "lessThan": "0ae8ad0013978f7471f22bcf45b027393e87f5dc",
              "status": "affected",
              "version": "44d9e52977a1b90b0db1c7f8b197c218e9226520",
              "versionType": "git"
            },
            {
              "lessThan": "bd97cea7b18a0a553773af806dfbfac27a7c4acb",
              "status": "affected",
              "version": "44d9e52977a1b90b0db1c7f8b197c218e9226520",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/irdma/hw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.150",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.150",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.80",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.19",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.7",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix KASAN issue with tasklet\n\nKASAN testing revealed the following issue assocated with freeing an IRQ.\n\n[50006.466686] Call Trace:\n[50006.466691]  \u003cIRQ\u003e\n[50006.489538]  dump_stack+0x5c/0x80\n[50006.493475]  print_address_description.constprop.6+0x1a/0x150\n[50006.499872]  ? irdma_sc_process_ceq+0x483/0x790 [irdma]\n[50006.505742]  ? irdma_sc_process_ceq+0x483/0x790 [irdma]\n[50006.511644]  kasan_report.cold.11+0x7f/0x118\n[50006.516572]  ? irdma_sc_process_ceq+0x483/0x790 [irdma]\n[50006.522473]  irdma_sc_process_ceq+0x483/0x790 [irdma]\n[50006.528232]  irdma_process_ceq+0xb2/0x400 [irdma]\n[50006.533601]  ? irdma_hw_flush_wqes_callback+0x370/0x370 [irdma]\n[50006.540298]  irdma_ceq_dpc+0x44/0x100 [irdma]\n[50006.545306]  tasklet_action_common.isra.14+0x148/0x2c0\n[50006.551096]  __do_softirq+0x1d0/0xaf8\n[50006.555396]  irq_exit_rcu+0x219/0x260\n[50006.559670]  irq_exit+0xa/0x20\n[50006.563320]  smp_apic_timer_interrupt+0x1bf/0x690\n[50006.568645]  apic_timer_interrupt+0xf/0x20\n[50006.573341]  \u003c/IRQ\u003e\n\nThe issue is that a tasklet could be pending on another core racing\nthe delete of the irq.\n\nFix by insuring any scheduled tasklet is killed after deleting the\nirq."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable window is opened by irdma/ice device teardown or PF reset and is exercised through local RDMA verbs access (/dev/infiniband/uverbs*) driving CEQ completion interrupts; no remote packet parsing reaches the free path.\nAC:L - The attacker controls both sides of the race \u2014 a sustained stream of RDMA completions keeps a CEQ tasklet pending on some CPU at essentially all times, so any teardown/reset deterministically lands in the window, and the freed kmalloc\u0027d irdma_ceq object is readily reclaimed by ordinary heap spray.\nPR:L - An unprivileged local user holding an RDMA context can drive the CEQ interrupt storm and provoke the PE/HMC critical-error path in irdma_iidc_event_handler() that self-requests a PF reset (main.c:119-145), tearing the device down without root; no capability in the init namespace is needed for the verbs path.\nUI:N - The teardown can be initiated by the attacker-provoked CRIT_ERR/PFR reset path rather than requiring an administrator to unload the module, so no action by another user is needed.\nS:U - The use-after-free and any resulting corruption are confined to the kernel\u0027s own memory and security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stale tasklet reads freed DMA and slab memory (iwceq-\u003erf, ceq ring, CEQE payloads) and, once reclaimed, the attacker-shaped object yields dereferences of arbitrary kernel addresses, enabling disclosure of kernel memory well beyond a bounded leak.\nI:H - irdma_sc_cq_ack() performs writel(cq-\u003ecq_uk.cq_id, cq-\u003ecq_uk.cq_ack_db) using two fields from the freed/reclaimed object \u2014 an arbitrary 32-bit write \u2014 and irdma_iwarp_ce_handler() makes an indirect call through cq-\u003eback_cq-\u003eibcq.comp_handler, giving control-flow hijack.\nA:H - Even unweaponized, the tasklet dereferences freed memory and treats garbage as a struct irdma_sc_cq pointer, producing an immediate oops/panic in softirq context (as shown by the KASAN splat) and taking the machine down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:27:44.934Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/635d79aa477f9912e602feb5498bdd51fb9cb824"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2e4a5266e3d133b4c7f0e43bf40d13ce14fd1aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6f1ca235f68b22b3e691b2ea87ac285e5946848"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ae8ad0013978f7471f22bcf45b027393e87f5dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd97cea7b18a0a553773af806dfbfac27a7c4acb"
        }
      ],
      "title": "RDMA/irdma: Fix KASAN issue with tasklet",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26838",
    "datePublished": "2024-04-17T10:10:04.871Z",
    "dateReserved": "2024-02-19T14:20:24.182Z",
    "dateUpdated": "2026-08-05T11:27:44.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/635d79aa477f9912e602feb5498bdd51fb9cb824\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b2e4a5266e3d133b4c7f0e43bf40d13ce14fd1aa\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c6f1ca235f68b22b3e691b2ea87ac285e5946848\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0ae8ad0013978f7471f22bcf45b027393e87f5dc\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/bd97cea7b18a0a553773af806dfbfac27a7c4acb\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.672Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26838\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-10T14:27:19.140994Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:24.299Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"RDMA/irdma: Fix KASAN issue with tasklet\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable window is opened by irdma/ice device teardown or PF reset and is exercised through local RDMA verbs access (/dev/infiniband/uverbs*) driving CEQ completion interrupts; no remote packet parsing reaches the free path.\\nAC:L - The attacker controls both sides of the race \\u2014 a sustained stream of RDMA completions keeps a CEQ tasklet pending on some CPU at essentially all times, so any teardown/reset deterministically lands in the window, and the freed kmalloc\u0027d irdma_ceq object is readily reclaimed by ordinary heap spray.\\nPR:L - An unprivileged local user holding an RDMA context can drive the CEQ interrupt storm and provoke the PE/HMC critical-error path in irdma_iidc_event_handler() that self-requests a PF reset (main.c:119-145), tearing the device down without root; no capability in the init namespace is needed for the verbs path.\\nUI:N - The teardown can be initiated by the attacker-provoked CRIT_ERR/PFR reset path rather than requiring an administrator to unload the module, so no action by another user is needed.\\nS:U - The use-after-free and any resulting corruption are confined to the kernel\u0027s own memory and security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The stale tasklet reads freed DMA and slab memory (iwceq-\u003erf, ceq ring, CEQE payloads) and, once reclaimed, the attacker-shaped object yields dereferences of arbitrary kernel addresses, enabling disclosure of kernel memory well beyond a bounded leak.\\nI:H - irdma_sc_cq_ack() performs writel(cq-\u003ecq_uk.cq_id, cq-\u003ecq_uk.cq_ack_db) using two fields from the freed/reclaimed object \\u2014 an arbitrary 32-bit write \\u2014 and irdma_iwarp_ce_handler() makes an indirect call through cq-\u003eback_cq-\u003eibcq.comp_handler, giving control-flow hijack.\\nA:H - Even unweaponized, the tasklet dereferences freed memory and treats garbage as a struct irdma_sc_cq pointer, producing an immediate oops/panic in softirq context (as shown by the KASAN splat) and taking the machine down.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"44d9e52977a1b90b0db1c7f8b197c218e9226520\", \"lessThan\": \"635d79aa477f9912e602feb5498bdd51fb9cb824\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"44d9e52977a1b90b0db1c7f8b197c218e9226520\", \"lessThan\": \"b2e4a5266e3d133b4c7f0e43bf40d13ce14fd1aa\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"44d9e52977a1b90b0db1c7f8b197c218e9226520\", \"lessThan\": \"c6f1ca235f68b22b3e691b2ea87ac285e5946848\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"44d9e52977a1b90b0db1c7f8b197c218e9226520\", \"lessThan\": \"0ae8ad0013978f7471f22bcf45b027393e87f5dc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"44d9e52977a1b90b0db1c7f8b197c218e9226520\", \"lessThan\": \"bd97cea7b18a0a553773af806dfbfac27a7c4acb\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/infiniband/hw/irdma/hw.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.150\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.80\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.19\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/infiniband/hw/irdma/hw.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/635d79aa477f9912e602feb5498bdd51fb9cb824\"}, {\"url\": \"https://git.kernel.org/stable/c/b2e4a5266e3d133b4c7f0e43bf40d13ce14fd1aa\"}, {\"url\": \"https://git.kernel.org/stable/c/c6f1ca235f68b22b3e691b2ea87ac285e5946848\"}, {\"url\": \"https://git.kernel.org/stable/c/0ae8ad0013978f7471f22bcf45b027393e87f5dc\"}, {\"url\": \"https://git.kernel.org/stable/c/bd97cea7b18a0a553773af806dfbfac27a7c4acb\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/irdma: Fix KASAN issue with tasklet\\n\\nKASAN testing revealed the following issue assocated with freeing an IRQ.\\n\\n[50006.466686] Call Trace:\\n[50006.466691]  \u003cIRQ\u003e\\n[50006.489538]  dump_stack+0x5c/0x80\\n[50006.493475]  print_address_description.constprop.6+0x1a/0x150\\n[50006.499872]  ? irdma_sc_process_ceq+0x483/0x790 [irdma]\\n[50006.505742]  ? irdma_sc_process_ceq+0x483/0x790 [irdma]\\n[50006.511644]  kasan_report.cold.11+0x7f/0x118\\n[50006.516572]  ? irdma_sc_process_ceq+0x483/0x790 [irdma]\\n[50006.522473]  irdma_sc_process_ceq+0x483/0x790 [irdma]\\n[50006.528232]  irdma_process_ceq+0xb2/0x400 [irdma]\\n[50006.533601]  ? irdma_hw_flush_wqes_callback+0x370/0x370 [irdma]\\n[50006.540298]  irdma_ceq_dpc+0x44/0x100 [irdma]\\n[50006.545306]  tasklet_action_common.isra.14+0x148/0x2c0\\n[50006.551096]  __do_softirq+0x1d0/0xaf8\\n[50006.555396]  irq_exit_rcu+0x219/0x260\\n[50006.559670]  irq_exit+0xa/0x20\\n[50006.563320]  smp_apic_timer_interrupt+0x1bf/0x690\\n[50006.568645]  apic_timer_interrupt+0xf/0x20\\n[50006.573341]  \u003c/IRQ\u003e\\n\\nThe issue is that a tasklet could be pending on another core racing\\nthe delete of the irq.\\n\\nFix by insuring any scheduled tasklet is killed after deleting the\\nirq.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.150\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.80\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.19\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.7\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"5.14\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:27:44.934Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26838\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:27:44.934Z\", \"dateReserved\": \"2024-02-19T14:20:24.182Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-17T10:10:04.871Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.