CVE-2024-26598Use After Free in Linux

CWE-416Use After Free34 documents8 sources
Severity
7.8HIGHNVD
OSV8.1OSV7.5OSV6.5OSV5.5
EPSS
0.0%
top 97.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedFeb 23
Latest updateAug 14

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command. The root of the problem is that vgic_its_check_cache() does not elevate the refcount on the vgic_irq before dropping the lock that serializes refcount changes. Have vgic_its_check_cache() raise the re

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages5 packages

NVDlinux/linux_kernel5.45.4.269+5
Debianlinux/linux_kernel< 5.10.209-1+3
Ubuntulinux/linux_kernel< 5.4.0-181.201+1
CVEListV5linux/linux6211753fdfd05af9e08f54c8d0ba3ee516034878d04acadb6490aa3314f9c9e087691e55de153b88+7
debiandebian/linux< linux 6.1.76-1 (bookworm)

Also affects: Debian Linux 10.0

Patches

🔴Vulnerability Details

16
OSV
linux-oracle-6.5 vulnerabilities2024-06-26
OSV
linux-hwe-6.5 vulnerabilities2024-06-18
OSV
linux-nvidia-6.5 vulnerabilities2024-06-14
OSV
linux-oem-6.5 vulnerabilities2024-06-12
OSV
linux-aws, linux-oracle vulnerabilities2024-06-11

📋Vendor Advisories

16
CISA ICS
Siemens SINEC OS2025-08-14
Ubuntu
Linux kernel (Oracle) vulnerabilities2024-06-26
Ubuntu
Linux kernel (HWE) vulnerabilities2024-06-18
Ubuntu
Linux kernel (NVIDIA) vulnerabilities2024-06-14
Ubuntu
Linux kernel (OEM) vulnerabilities2024-06-12

💬Community

1
Bugzilla
CVE-2024-26598 kernel: kvm: Avoid potential UAF in LPI translation cache2024-02-24