CVE-2024-26926 (GCVE-0-2024-26926)
Vulnerability from cvelistv5
Published
2024-04-24 23:23
Modified
2026-08-05 11:28
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: binder: check offset alignment in binder_get_object() Commit 6d98eb95b450 ("binder: avoid potential data leakage when copying txn") introduced changes to how binder objects are copied. In doing so, it unintentionally removed an offset alignment check done through calls to binder_alloc_copy_from_buffer() -> check_buffer(). These calls were replaced in binder_get_object() with copy_from_user(), so now an explicit offset alignment check is needed here. This avoids later complications when unwinding the objects gets harder. It is worth noting this check existed prior to commit 7a67a39320df ("binder: add function to copy binder object from buffer"), likely removed due to redundancy at the time.
References
Impacted products
Vendor Product Version
Linux Linux Version: c056a6ba35e00ae943e377eb09abd77a6915b31a
Version: 23e9d815fad84c1bee3742a8de4bd39510435362
Version: 7a9ad4aceb0226b391c9d3b8e4ac2e7d438b6bde
Version: 6d98eb95b450a75adb4516a1d33652dc78d2b20c
Version: 6d98eb95b450a75adb4516a1d33652dc78d2b20c
Version: 6d98eb95b450a75adb4516a1d33652dc78d2b20c
Version: 6d98eb95b450a75adb4516a1d33652dc78d2b20c
Version: 66e12f5b3a9733f941893a00753b10498724607d
Version: 5.4.226   ≤
Version: 5.10.157   ≤
Version: 5.15.17   ≤
Version: 5.16.3   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "68a28f551e46",
                "status": "affected",
                "version": "c056a6ba35e0",
                "versionType": "custom"
              },
              {
                "lessThan": "48a1f83ca9c6",
                "status": "affected",
                "version": "23e9d815fad8",
                "versionType": "custom"
              },
              {
                "lessThan": "a2fd6dbc98be",
                "status": "affected",
                "version": "7a9ad4aceb02",
                "versionType": "custom"
              },
              {
                "lessThan": "a6d2a8b211c8",
                "status": "affected",
                "version": "6d98eb95b450",
                "versionType": "custom"
              },
              {
                "lessThan": "1d7f1049035b",
                "status": "affected",
                "version": "6d98eb95b450",
                "versionType": "custom"
              },
              {
                "lessThan": "f01d66190457",
                "status": "affected",
                "version": "6d98eb95b450",
                "versionType": "custom"
              },
              {
                "lessThan": "aaef73821a3b",
                "status": "affected",
                "version": "6d98eb95b450",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.17"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26926",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-13T03:55:21.790532Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-13T14:39:55.884Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.552Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/android/binder.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "68a28f551e4690db2b27b3db716c7395f6fada12",
              "status": "affected",
              "version": "c056a6ba35e00ae943e377eb09abd77a6915b31a",
              "versionType": "git"
            },
            {
              "lessThan": "48a1f83ca9c68518b1a783c62e6a8223144fa9fc",
              "status": "affected",
              "version": "23e9d815fad84c1bee3742a8de4bd39510435362",
              "versionType": "git"
            },
            {
              "lessThan": "a2fd6dbc98be1105a1d8e9e31575da8873ef115c",
              "status": "affected",
              "version": "7a9ad4aceb0226b391c9d3b8e4ac2e7d438b6bde",
              "versionType": "git"
            },
            {
              "lessThan": "a6d2a8b211c874971ee4cf3ddd167408177f6e76",
              "status": "affected",
              "version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
              "versionType": "git"
            },
            {
              "lessThan": "1d7f1049035b2060342f11eff957cf567d810bdc",
              "status": "affected",
              "version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
              "versionType": "git"
            },
            {
              "lessThan": "f01d6619045704d78613b14e2e0420bfdb7f1c15",
              "status": "affected",
              "version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
              "versionType": "git"
            },
            {
              "lessThan": "aaef73821a3b0194a01bd23ca77774f704a04d40",
              "status": "affected",
              "version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "66e12f5b3a9733f941893a00753b10498724607d",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.275",
              "status": "affected",
              "version": "5.4.226",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.216",
              "status": "affected",
              "version": "5.10.157",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.157",
              "status": "affected",
              "version": "5.15.17",
              "versionType": "semver"
            },
            {
              "lessThan": "5.17",
              "status": "affected",
              "version": "5.16.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/android/binder.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.275",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.275",
                  "versionStartIncluding": "5.4.226",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.216",
                  "versionStartIncluding": "5.10.157",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.157",
                  "versionStartIncluding": "5.15.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.88",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.29",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.8",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.16.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: check offset alignment in binder_get_object()\n\nCommit 6d98eb95b450 (\"binder: avoid potential data leakage when copying\ntxn\") introduced changes to how binder objects are copied. In doing so,\nit unintentionally removed an offset alignment check done through calls\nto binder_alloc_copy_from_buffer() -\u003e check_buffer().\n\nThese calls were replaced in binder_get_object() with copy_from_user(),\nso now an explicit offset alignment check is needed here. This avoids\nlater complications when unwinding the objects gets harder.\n\nIt is worth noting this check existed prior to commit 7a67a39320df\n(\"binder: add function to copy binder object from buffer\"), likely\nremoved due to redundancy at the time."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through `ioctl(BINDER_WRITE_READ)` with `BC_TRANSACTION` on `/dev/binder` or a binderfs device node, requiring local access to the system. There is no remote or adjacent-network path into `binder_transaction()`.\nAC:L - The attacker fully and deterministically controls the offsets array and the transaction payload, so supplying a misaligned offset triggers the flawed path on the first try with no race, timing, or memory-layout dependency.\nPR:L - Any unprivileged local process can drive this \u2014 on Android every installed app holds binder access by design, and on general-purpose kernels binderfs is `FS_USERNS_MOUNT` while `BINDER_SET_CONTEXT_MGR` carries no capability check, so an ordinary user can set up both sender and target inside `unshare -Urn`.\nUI:N - The attacker issues the malformed transaction entirely from its own process; no victim action, file open, or mount by another user is needed.\nS:U - The mismanaged state is binder driver data owned by the kernel, and impact remains within the kernel\u0027s own security authority rather than crossing a hypervisor, IOMMU, or sandbox boundary.\nC:H - Dropping the alignment guard lets an unprivileged process desynchronize binder\u0027s object accounting so that `binder_node`/`binder_ref` lifetimes are no longer correctly tracked by the driver\u0027s refcounting \u2014 the same protection that prevents stale-object access \u2014 and this class of binder bookkeeping flaw is the established route to kernel memory read primitives on Android.\nI:H - The attacker causes unauthorized, permanent modification of another process\u0027s binder reference table and of node reference counts, state the attacker has no right to alter, and the resulting lifetime-tracking inconsistency is memory-safety relevant and leveragable toward write primitives.\nA:H - Every malformed transaction leaks a `binder_node` plus a `binder_ref` that the unwind path can never reclaim, and the loop can be repeated without bound against a chosen victim process, driving unreclaimable kernel allocation to OOM on memory-constrained Android and embedded devices."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:28:24.537Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12"
        },
        {
          "url": "https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc"
        },
        {
          "url": "https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15"
        },
        {
          "url": "https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40"
        }
      ],
      "title": "binder: check offset alignment in binder_get_object()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26926",
    "datePublished": "2024-04-24T23:23:40.600Z",
    "dateReserved": "2024-02-19T14:20:24.194Z",
    "dateUpdated": "2026-08-05T11:28:24.537Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:21:05.552Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26926\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-13T03:55:21.790532Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"c056a6ba35e0\", \"lessThan\": \"68a28f551e46\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"23e9d815fad8\", \"lessThan\": \"48a1f83ca9c6\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"7a9ad4aceb02\", \"lessThan\": \"a2fd6dbc98be\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6d98eb95b450\", \"lessThan\": \"a6d2a8b211c8\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6d98eb95b450\", \"lessThan\": \"1d7f1049035b\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6d98eb95b450\", \"lessThan\": \"f01d66190457\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6d98eb95b450\", \"lessThan\": \"aaef73821a3b\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.17\"}], \"defaultStatus\": \"affected\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-13T14:39:51.124Z\"}}], \"cna\": {\"title\": \"binder: check offset alignment in binder_get_object()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is reached through `ioctl(BINDER_WRITE_READ)` with `BC_TRANSACTION` on `/dev/binder` or a binderfs device node, requiring local access to the system. There is no remote or adjacent-network path into `binder_transaction()`.\\nAC:L - The attacker fully and deterministically controls the offsets array and the transaction payload, so supplying a misaligned offset triggers the flawed path on the first try with no race, timing, or memory-layout dependency.\\nPR:L - Any unprivileged local process can drive this \\u2014 on Android every installed app holds binder access by design, and on general-purpose kernels binderfs is `FS_USERNS_MOUNT` while `BINDER_SET_CONTEXT_MGR` carries no capability check, so an ordinary user can set up both sender and target inside `unshare -Urn`.\\nUI:N - The attacker issues the malformed transaction entirely from its own process; no victim action, file open, or mount by another user is needed.\\nS:U - The mismanaged state is binder driver data owned by the kernel, and impact remains within the kernel\u0027s own security authority rather than crossing a hypervisor, IOMMU, or sandbox boundary.\\nC:H - Dropping the alignment guard lets an unprivileged process desynchronize binder\u0027s object accounting so that `binder_node`/`binder_ref` lifetimes are no longer correctly tracked by the driver\u0027s refcounting \\u2014 the same protection that prevents stale-object access \\u2014 and this class of binder bookkeeping flaw is the established route to kernel memory read primitives on Android.\\nI:H - The attacker causes unauthorized, permanent modification of another process\u0027s binder reference table and of node reference counts, state the attacker has no right to alter, and the resulting lifetime-tracking inconsistency is memory-safety relevant and leveragable toward write primitives.\\nA:H - Every malformed transaction leaks a `binder_node` plus a `binder_ref` that the unwind path can never reclaim, and the loop can be repeated without bound against a chosen victim process, driving unreclaimable kernel allocation to OOM on memory-constrained Android and embedded devices.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c056a6ba35e00ae943e377eb09abd77a6915b31a\", \"lessThan\": \"68a28f551e4690db2b27b3db716c7395f6fada12\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"23e9d815fad84c1bee3742a8de4bd39510435362\", \"lessThan\": \"48a1f83ca9c68518b1a783c62e6a8223144fa9fc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7a9ad4aceb0226b391c9d3b8e4ac2e7d438b6bde\", \"lessThan\": \"a2fd6dbc98be1105a1d8e9e31575da8873ef115c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6d98eb95b450a75adb4516a1d33652dc78d2b20c\", \"lessThan\": \"a6d2a8b211c874971ee4cf3ddd167408177f6e76\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6d98eb95b450a75adb4516a1d33652dc78d2b20c\", \"lessThan\": \"1d7f1049035b2060342f11eff957cf567d810bdc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6d98eb95b450a75adb4516a1d33652dc78d2b20c\", \"lessThan\": \"f01d6619045704d78613b14e2e0420bfdb7f1c15\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6d98eb95b450a75adb4516a1d33652dc78d2b20c\", \"lessThan\": \"aaef73821a3b0194a01bd23ca77774f704a04d40\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"66e12f5b3a9733f941893a00753b10498724607d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.4.226\", \"lessThan\": \"5.4.275\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.10.157\", \"lessThan\": \"5.10.216\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.15.17\", \"lessThan\": \"5.15.157\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.16.3\", \"lessThan\": \"5.17\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/android/binder.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.17\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.17\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.275\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.216\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.157\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.88\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.29\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/android/binder.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12\"}, {\"url\": \"https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc\"}, {\"url\": \"https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c\"}, {\"url\": \"https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76\"}, {\"url\": \"https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc\"}, {\"url\": \"https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15\"}, {\"url\": \"https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbinder: check offset alignment in binder_get_object()\\n\\nCommit 6d98eb95b450 (\\\"binder: avoid potential data leakage when copying\\ntxn\\\") introduced changes to how binder objects are copied. In doing so,\\nit unintentionally removed an offset alignment check done through calls\\nto binder_alloc_copy_from_buffer() -\u003e check_buffer().\\n\\nThese calls were replaced in binder_get_object() with copy_from_user(),\\nso now an explicit offset alignment check is needed here. This avoids\\nlater complications when unwinding the objects gets harder.\\n\\nIt is worth noting this check existed prior to commit 7a67a39320df\\n(\\\"binder: add function to copy binder object from buffer\\\"), likely\\nremoved due to redundancy at the time.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.275\", \"versionStartIncluding\": \"5.4.226\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.216\", \"versionStartIncluding\": \"5.10.157\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.157\", \"versionStartIncluding\": \"5.15.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.88\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.29\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.8\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.16.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:28:24.537Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26926\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:28:24.537Z\", \"dateReserved\": \"2024-02-19T14:20:24.194Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-24T23:23:40.600Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.