CVE-2024-26759 (GCVE-0-2024-26759)

Vulnerability from cvelistv5 – Published: 2024-04-03 17:00 – Updated: 2025-05-04 08:55
VLAI?
Title
mm/swap: fix race when skipping swapcache
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix race when skipping swapcache When skipping swapcache for SWP_SYNCHRONOUS_IO, if two or more threads swapin the same entry at the same time, they get different pages (A, B). Before one thread (T0) finishes the swapin and installs page (A) to the PTE, another thread (T1) could finish swapin of page (B), swap_free the entry, then swap out the possibly modified page reusing the same entry. It breaks the pte_same check in (T0) because PTE value is unchanged, causing ABA problem. Thread (T0) will install a stalled page (A) into the PTE and cause data corruption. One possible callstack is like this: CPU0 CPU1 ---- ---- do_swap_page() do_swap_page() with same entry <direct swapin path> <direct swapin path> <alloc page A> <alloc page B> swap_read_folio() <- read to page A swap_read_folio() <- read to page B <slow on later locks or interrupt> <finished swapin first> ... set_pte_at() swap_free() <- entry is free <write to page B, now page A stalled> <swap out page B to same swap entry> pte_same() <- Check pass, PTE seems unchanged, but page A is stalled! swap_free() <- page B content lost! set_pte_at() <- staled page A installed! And besides, for ZRAM, swap_free() allows the swap device to discard the entry content, so even if page (B) is not modified, if swap_read_folio() on CPU0 happens later than swap_free() on CPU1, it may also cause data loss. To fix this, reuse swapcache_prepare which will pin the swap entry using the cache flag, and allow only one thread to swap it in, also prevent any parallel code from putting the entry in the cache. Release the pin after PT unlocked. Racers just loop and wait since it's a rare and very short event. A schedule_timeout_uninterruptible(1) call is added to avoid repeated page faults wasting too much CPU, causing livelock or adding too much noise to perf statistics. A similar livelock issue was described in commit 029c4628b2eb ("mm: swap: get rid of livelock in swapin readahead") Reproducer: This race issue can be triggered easily using a well constructed reproducer and patched brd (with a delay in read path) [1]: With latest 6.8 mainline, race caused data loss can be observed easily: $ gcc -g -lpthread test-thread-swap-race.c && ./a.out Polulating 32MB of memory region... Keep swapping out... Starting round 0... Spawning 65536 workers... 32746 workers spawned, wait for done... Round 0: Error on 0x5aa00, expected 32746, got 32743, 3 data loss! Round 0: Error on 0x395200, expected 32746, got 32743, 3 data loss! Round 0: Error on 0x3fd000, expected 32746, got 32737, 9 data loss! Round 0 Failed, 15 data loss! This reproducer spawns multiple threads sharing the same memory region using a small swap device. Every two threads updates mapped pages one by one in opposite direction trying to create a race, with one dedicated thread keep swapping out the data out using madvise. The reproducer created a reproduce rate of about once every 5 minutes, so the race should be totally possible in production. After this patch, I ran the reproducer for over a few hundred rounds and no data loss observed. Performance overhead is minimal, microbenchmark swapin 10G from 32G zram: Before: 10934698 us After: 11157121 us Cached: 13155355 us (Dropping SWP_SYNCHRONOUS_IO flag) [kasong@tencent.com: v4]
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 0bcac06f27d7528591c27ac2b093ccd71c5d0168 , < 2dedda77d4493f3e92e414b272bfa60f1f51ed95 (git)
Affected: 0bcac06f27d7528591c27ac2b093ccd71c5d0168 , < 305152314df82b22cf9b181f3dc5fc411002079a (git)
Affected: 0bcac06f27d7528591c27ac2b093ccd71c5d0168 , < d183a4631acfc7af955c02a02e739cec15f5234d (git)
Affected: 0bcac06f27d7528591c27ac2b093ccd71c5d0168 , < 13ddaf26be324a7f951891ecd9ccd04466d27458 (git)
Create a notification for this product.
    Linux Linux Affected: 4.15
Unaffected: 0 , < 4.15 (semver)
Unaffected: 6.1.80 , ≤ 6.1.* (semver)
Unaffected: 6.6.19 , ≤ 6.6.* (semver)
Unaffected: 6.7.7 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26759",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-08T14:03:53.009974Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:49:35.865Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.279Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2dedda77d4493f3e92e414b272bfa60f1f51ed95"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/305152314df82b22cf9b181f3dc5fc411002079a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d183a4631acfc7af955c02a02e739cec15f5234d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/13ddaf26be324a7f951891ecd9ccd04466d27458"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/swap.h",
            "mm/memory.c",
            "mm/swap.h",
            "mm/swapfile.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2dedda77d4493f3e92e414b272bfa60f1f51ed95",
              "status": "affected",
              "version": "0bcac06f27d7528591c27ac2b093ccd71c5d0168",
              "versionType": "git"
            },
            {
              "lessThan": "305152314df82b22cf9b181f3dc5fc411002079a",
              "status": "affected",
              "version": "0bcac06f27d7528591c27ac2b093ccd71c5d0168",
              "versionType": "git"
            },
            {
              "lessThan": "d183a4631acfc7af955c02a02e739cec15f5234d",
              "status": "affected",
              "version": "0bcac06f27d7528591c27ac2b093ccd71c5d0168",
              "versionType": "git"
            },
            {
              "lessThan": "13ddaf26be324a7f951891ecd9ccd04466d27458",
              "status": "affected",
              "version": "0bcac06f27d7528591c27ac2b093ccd71c5d0168",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/swap.h",
            "mm/memory.c",
            "mm/swap.h",
            "mm/swapfile.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.80",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.19",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.7",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/swap: fix race when skipping swapcache\n\nWhen skipping swapcache for SWP_SYNCHRONOUS_IO, if two or more threads\nswapin the same entry at the same time, they get different pages (A, B). \nBefore one thread (T0) finishes the swapin and installs page (A) to the\nPTE, another thread (T1) could finish swapin of page (B), swap_free the\nentry, then swap out the possibly modified page reusing the same entry. \nIt breaks the pte_same check in (T0) because PTE value is unchanged,\ncausing ABA problem.  Thread (T0) will install a stalled page (A) into the\nPTE and cause data corruption.\n\nOne possible callstack is like this:\n\nCPU0                                 CPU1\n----                                 ----\ndo_swap_page()                       do_swap_page() with same entry\n\u003cdirect swapin path\u003e                 \u003cdirect swapin path\u003e\n\u003calloc page A\u003e                       \u003calloc page B\u003e\nswap_read_folio() \u003c- read to page A  swap_read_folio() \u003c- read to page B\n\u003cslow on later locks or interrupt\u003e   \u003cfinished swapin first\u003e\n...                                  set_pte_at()\n                                     swap_free() \u003c- entry is free\n                                     \u003cwrite to page B, now page A stalled\u003e\n                                     \u003cswap out page B to same swap entry\u003e\npte_same() \u003c- Check pass, PTE seems\n              unchanged, but page A\n              is stalled!\nswap_free() \u003c- page B content lost!\nset_pte_at() \u003c- staled page A installed!\n\nAnd besides, for ZRAM, swap_free() allows the swap device to discard the\nentry content, so even if page (B) is not modified, if swap_read_folio()\non CPU0 happens later than swap_free() on CPU1, it may also cause data\nloss.\n\nTo fix this, reuse swapcache_prepare which will pin the swap entry using\nthe cache flag, and allow only one thread to swap it in, also prevent any\nparallel code from putting the entry in the cache.  Release the pin after\nPT unlocked.\n\nRacers just loop and wait since it\u0027s a rare and very short event.  A\nschedule_timeout_uninterruptible(1) call is added to avoid repeated page\nfaults wasting too much CPU, causing livelock or adding too much noise to\nperf statistics.  A similar livelock issue was described in commit\n029c4628b2eb (\"mm: swap: get rid of livelock in swapin readahead\")\n\nReproducer:\n\nThis race issue can be triggered easily using a well constructed\nreproducer and patched brd (with a delay in read path) [1]:\n\nWith latest 6.8 mainline, race caused data loss can be observed easily:\n$ gcc -g -lpthread test-thread-swap-race.c \u0026\u0026 ./a.out\n  Polulating 32MB of memory region...\n  Keep swapping out...\n  Starting round 0...\n  Spawning 65536 workers...\n  32746 workers spawned, wait for done...\n  Round 0: Error on 0x5aa00, expected 32746, got 32743, 3 data loss!\n  Round 0: Error on 0x395200, expected 32746, got 32743, 3 data loss!\n  Round 0: Error on 0x3fd000, expected 32746, got 32737, 9 data loss!\n  Round 0 Failed, 15 data loss!\n\nThis reproducer spawns multiple threads sharing the same memory region\nusing a small swap device.  Every two threads updates mapped pages one by\none in opposite direction trying to create a race, with one dedicated\nthread keep swapping out the data out using madvise.\n\nThe reproducer created a reproduce rate of about once every 5 minutes, so\nthe race should be totally possible in production.\n\nAfter this patch, I ran the reproducer for over a few hundred rounds and\nno data loss observed.\n\nPerformance overhead is minimal, microbenchmark swapin 10G from 32G\nzram:\n\nBefore:     10934698 us\nAfter:      11157121 us\nCached:     13155355 us (Dropping SWP_SYNCHRONOUS_IO flag)\n\n[kasong@tencent.com: v4]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:55:52.045Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2dedda77d4493f3e92e414b272bfa60f1f51ed95"
        },
        {
          "url": "https://git.kernel.org/stable/c/305152314df82b22cf9b181f3dc5fc411002079a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d183a4631acfc7af955c02a02e739cec15f5234d"
        },
        {
          "url": "https://git.kernel.org/stable/c/13ddaf26be324a7f951891ecd9ccd04466d27458"
        }
      ],
      "title": "mm/swap: fix race when skipping swapcache",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26759",
    "datePublished": "2024-04-03T17:00:43.288Z",
    "dateReserved": "2024-02-19T14:20:24.170Z",
    "dateUpdated": "2025-05-04T08:55:52.045Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2dedda77d4493f3e92e414b272bfa60f1f51ed95\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/305152314df82b22cf9b181f3dc5fc411002079a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d183a4631acfc7af955c02a02e739cec15f5234d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/13ddaf26be324a7f951891ecd9ccd04466d27458\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.279Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26759\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-08T14:03:53.009974Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:22.409Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"mm/swap: fix race when skipping swapcache\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0bcac06f27d7528591c27ac2b093ccd71c5d0168\", \"lessThan\": \"2dedda77d4493f3e92e414b272bfa60f1f51ed95\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0bcac06f27d7528591c27ac2b093ccd71c5d0168\", \"lessThan\": \"305152314df82b22cf9b181f3dc5fc411002079a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0bcac06f27d7528591c27ac2b093ccd71c5d0168\", \"lessThan\": \"d183a4631acfc7af955c02a02e739cec15f5234d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0bcac06f27d7528591c27ac2b093ccd71c5d0168\", \"lessThan\": \"13ddaf26be324a7f951891ecd9ccd04466d27458\", \"versionType\": \"git\"}], \"programFiles\": [\"include/linux/swap.h\", \"mm/memory.c\", \"mm/swap.h\", \"mm/swapfile.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.80\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.19\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/linux/swap.h\", \"mm/memory.c\", \"mm/swap.h\", \"mm/swapfile.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2dedda77d4493f3e92e414b272bfa60f1f51ed95\"}, {\"url\": \"https://git.kernel.org/stable/c/305152314df82b22cf9b181f3dc5fc411002079a\"}, {\"url\": \"https://git.kernel.org/stable/c/d183a4631acfc7af955c02a02e739cec15f5234d\"}, {\"url\": \"https://git.kernel.org/stable/c/13ddaf26be324a7f951891ecd9ccd04466d27458\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/swap: fix race when skipping swapcache\\n\\nWhen skipping swapcache for SWP_SYNCHRONOUS_IO, if two or more threads\\nswapin the same entry at the same time, they get different pages (A, B). \\nBefore one thread (T0) finishes the swapin and installs page (A) to the\\nPTE, another thread (T1) could finish swapin of page (B), swap_free the\\nentry, then swap out the possibly modified page reusing the same entry. \\nIt breaks the pte_same check in (T0) because PTE value is unchanged,\\ncausing ABA problem.  Thread (T0) will install a stalled page (A) into the\\nPTE and cause data corruption.\\n\\nOne possible callstack is like this:\\n\\nCPU0                                 CPU1\\n----                                 ----\\ndo_swap_page()                       do_swap_page() with same entry\\n\u003cdirect swapin path\u003e                 \u003cdirect swapin path\u003e\\n\u003calloc page A\u003e                       \u003calloc page B\u003e\\nswap_read_folio() \u003c- read to page A  swap_read_folio() \u003c- read to page B\\n\u003cslow on later locks or interrupt\u003e   \u003cfinished swapin first\u003e\\n...                                  set_pte_at()\\n                                     swap_free() \u003c- entry is free\\n                                     \u003cwrite to page B, now page A stalled\u003e\\n                                     \u003cswap out page B to same swap entry\u003e\\npte_same() \u003c- Check pass, PTE seems\\n              unchanged, but page A\\n              is stalled!\\nswap_free() \u003c- page B content lost!\\nset_pte_at() \u003c- staled page A installed!\\n\\nAnd besides, for ZRAM, swap_free() allows the swap device to discard the\\nentry content, so even if page (B) is not modified, if swap_read_folio()\\non CPU0 happens later than swap_free() on CPU1, it may also cause data\\nloss.\\n\\nTo fix this, reuse swapcache_prepare which will pin the swap entry using\\nthe cache flag, and allow only one thread to swap it in, also prevent any\\nparallel code from putting the entry in the cache.  Release the pin after\\nPT unlocked.\\n\\nRacers just loop and wait since it\u0027s a rare and very short event.  A\\nschedule_timeout_uninterruptible(1) call is added to avoid repeated page\\nfaults wasting too much CPU, causing livelock or adding too much noise to\\nperf statistics.  A similar livelock issue was described in commit\\n029c4628b2eb (\\\"mm: swap: get rid of livelock in swapin readahead\\\")\\n\\nReproducer:\\n\\nThis race issue can be triggered easily using a well constructed\\nreproducer and patched brd (with a delay in read path) [1]:\\n\\nWith latest 6.8 mainline, race caused data loss can be observed easily:\\n$ gcc -g -lpthread test-thread-swap-race.c \u0026\u0026 ./a.out\\n  Polulating 32MB of memory region...\\n  Keep swapping out...\\n  Starting round 0...\\n  Spawning 65536 workers...\\n  32746 workers spawned, wait for done...\\n  Round 0: Error on 0x5aa00, expected 32746, got 32743, 3 data loss!\\n  Round 0: Error on 0x395200, expected 32746, got 32743, 3 data loss!\\n  Round 0: Error on 0x3fd000, expected 32746, got 32737, 9 data loss!\\n  Round 0 Failed, 15 data loss!\\n\\nThis reproducer spawns multiple threads sharing the same memory region\\nusing a small swap device.  Every two threads updates mapped pages one by\\none in opposite direction trying to create a race, with one dedicated\\nthread keep swapping out the data out using madvise.\\n\\nThe reproducer created a reproduce rate of about once every 5 minutes, so\\nthe race should be totally possible in production.\\n\\nAfter this patch, I ran the reproducer for over a few hundred rounds and\\nno data loss observed.\\n\\nPerformance overhead is minimal, microbenchmark swapin 10G from 32G\\nzram:\\n\\nBefore:     10934698 us\\nAfter:      11157121 us\\nCached:     13155355 us (Dropping SWP_SYNCHRONOUS_IO flag)\\n\\n[kasong@tencent.com: v4]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.80\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.19\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.7\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"4.15\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T08:55:52.045Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26759\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T08:55:52.045Z\", \"dateReserved\": \"2024-02-19T14:20:24.170Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-03T17:00:43.288Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.