CVE-2024-26907 — Use After Free in Linux

CWE-416 — Use After FreeCWE-99 — Resource Injection35 documents8 sources
Severity
7.8HIGHNVD
OSV7.0OSV6.5OSV5.5
EPSS
0.0%
top 99.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
LinuxLinux KernelDebian Linux+4 more
Timeline
PublishedApr 17
Latest updateAug 22

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix fortify source warning while accessing Eth segment ------------[ cut here ]------------ memcpy: detected field-spanning write (size 56) of single field "eseg->inline_hdr.start" at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 (size 2) WARNING: CPU: 0 PID: 293779 at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages9 packages

▶NVDlinux/linux_kernel5.11 — 5.15.153+4
▶Debianlinux/linux_kernel< 5.10.216-1+3
▶Ubuntulinux/linux_kernel< 5.4.0-190.210+1

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

16
OSV
linux-raspi-5.4 vulnerabilities↗2024-08-22
▶
OSV
linux-oracle, linux-oracle-5.4 vulnerabilities↗2024-08-09
▶
OSV
linux-aws, linux-aws-5.4 vulnerabilities↗2024-07-30
▶
OSV
linux, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-raspi, linux-xilinx-zynqmp vulnerabili↗2024-07-29
▶
OSV
linux-raspi vulnerabilities↗2024-07-26
▶

📋Vendor Advisories

17
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities↗2024-08-22
▶
Ubuntu
Linux kernel (Oracle) vulnerabilities↗2024-08-09
▶
Ubuntu
Linux kernel vulnerabilities↗2024-07-30
▶
Ubuntu
Linux kernel vulnerabilities↗2024-07-29
▶
Ubuntu
Linux kernel vulnerabilities↗2024-07-26
▶

💬Community

1
Bugzilla
CVE-2024-26907 kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment↗2024-04-17
▶