CVE-2024-26780 (GCVE-0-2024-26780)

Vulnerability from cvelistv5 – Published: 2024-04-04 08:20 – Updated: 2025-05-04 08:56
VLAI?
Title
af_unix: Fix task hung while purging oob_skb in GC.
Summary
In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix task hung while purging oob_skb in GC. syzbot reported a task hung; at the same time, GC was looping infinitely in list_for_each_entry_safe() for OOB skb. [0] syzbot demonstrated that the list_for_each_entry_safe() was not actually safe in this case. A single skb could have references for multiple sockets. If we free such a skb in the list_for_each_entry_safe(), the current and next sockets could be unlinked in a single iteration. unix_notinflight() uses list_del_init() to unlink the socket, so the prefetched next socket forms a loop itself and list_for_each_entry_safe() never stops. Here, we must use while() and make sure we always fetch the first socket. [0]: Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 5065 Comm: syz-executor236 Not tainted 6.8.0-rc3-syzkaller-00136-g1f719a2f3fa6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:26 [inline] RIP: 0010:check_kcov_mode kernel/kcov.c:173 [inline] RIP: 0010:__sanitizer_cov_trace_pc+0xd/0x60 kernel/kcov.c:207 Code: cc cc cc cc 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 65 48 8b 14 25 40 c2 03 00 <65> 8b 05 b4 7c 78 7e a9 00 01 ff 00 48 8b 34 24 74 0f f6 c4 01 74 RSP: 0018:ffffc900033efa58 EFLAGS: 00000283 RAX: ffff88807b077800 RBX: ffff88807b077800 RCX: 1ffffffff27b1189 RDX: ffff88802a5a3b80 RSI: ffffffff8968488d RDI: ffff88807b077f70 RBP: ffffc900033efbb0 R08: 0000000000000001 R09: fffffbfff27a900c R10: ffffffff93d48067 R11: ffffffff8ae000eb R12: ffff88807b077800 R13: dffffc0000000000 R14: ffff88807b077e40 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000564f4fc1e3a8 CR3: 000000000d57a000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <NMI> </NMI> <TASK> unix_gc+0x563/0x13b0 net/unix/garbage.c:319 unix_release_sock+0xa93/0xf80 net/unix/af_unix.c:683 unix_release+0x91/0xf0 net/unix/af_unix.c:1064 __sock_release+0xb0/0x270 net/socket.c:659 sock_close+0x1c/0x30 net/socket.c:1421 __fput+0x270/0xb80 fs/file_table.c:376 task_work_run+0x14f/0x250 kernel/task_work.c:180 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xa8a/0x2ad0 kernel/exit.c:871 do_group_exit+0xd4/0x2a0 kernel/exit.c:1020 __do_sys_exit_group kernel/exit.c:1031 [inline] __se_sys_exit_group kernel/exit.c:1029 [inline] __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1029 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7f9d6cbdac09 Code: Unable to access opcode bytes at 0x7f9d6cbdabdf. RSP: 002b:00007fff5952feb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9d6cbdac09 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 RBP: 00007f9d6cc552b0 R08: ffffffffffffffb8 R09: 0000000000000006 R10: 0000000000000006 R11: 0000000000000246 R12: 00007f9d6cc552b0 R13: 0000000000000000 R14: 00007f9d6cc55d00 R15: 00007f9d6cbabe70 </TASK>
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 4fe505c63aa3273135a57597fda761e9aecc7668 , < 36f7371de977f805750748e80279be7e370df85c (git)
Affected: e0e09186d8821ad59806115d347ea32efa43ca4b , < 2a3d40b4025fcfe51b04924979f1653993b17669 (git)
Affected: b74aa9ce13d02b7fd37c5325b99854f91b9b4276 , < 69e0f04460f4037e01e29f0d9675544f62aafca3 (git)
Affected: 82ae47c5c3a6b27fdc0f9e83c1499cb439c56140 , < cb8890318dde26fc89c6ea67d6e9070ab50b6e91 (git)
Affected: 1279f9d9dec2d7462823a18c29ad61359e0a007d , < 25236c91b5ab4a26a56ba2e79b8060cf4e047839 (git)
Create a notification for this product.
    Linux Linux Affected: 6.1.78 , < 6.1.81 (semver)
Affected: 6.6.17 , < 6.6.21 (semver)
Affected: 6.7.5 , < 6.7.9 (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.403Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/36f7371de977f805750748e80279be7e370df85c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2a3d40b4025fcfe51b04924979f1653993b17669"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/69e0f04460f4037e01e29f0d9675544f62aafca3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cb8890318dde26fc89c6ea67d6e9070ab50b6e91"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/25236c91b5ab4a26a56ba2e79b8060cf4e047839"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26780",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:51:08.468266Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:52.933Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/unix/garbage.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "36f7371de977f805750748e80279be7e370df85c",
              "status": "affected",
              "version": "4fe505c63aa3273135a57597fda761e9aecc7668",
              "versionType": "git"
            },
            {
              "lessThan": "2a3d40b4025fcfe51b04924979f1653993b17669",
              "status": "affected",
              "version": "e0e09186d8821ad59806115d347ea32efa43ca4b",
              "versionType": "git"
            },
            {
              "lessThan": "69e0f04460f4037e01e29f0d9675544f62aafca3",
              "status": "affected",
              "version": "b74aa9ce13d02b7fd37c5325b99854f91b9b4276",
              "versionType": "git"
            },
            {
              "lessThan": "cb8890318dde26fc89c6ea67d6e9070ab50b6e91",
              "status": "affected",
              "version": "82ae47c5c3a6b27fdc0f9e83c1499cb439c56140",
              "versionType": "git"
            },
            {
              "lessThan": "25236c91b5ab4a26a56ba2e79b8060cf4e047839",
              "status": "affected",
              "version": "1279f9d9dec2d7462823a18c29ad61359e0a007d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/unix/garbage.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.1.81",
              "status": "affected",
              "version": "6.1.78",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.21",
              "status": "affected",
              "version": "6.6.17",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7.9",
              "status": "affected",
              "version": "6.7.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.81",
                  "versionStartIncluding": "6.1.78",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.21",
                  "versionStartIncluding": "6.6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.9",
                  "versionStartIncluding": "6.7.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Fix task hung while purging oob_skb in GC.\n\nsyzbot reported a task hung; at the same time, GC was looping infinitely\nin list_for_each_entry_safe() for OOB skb.  [0]\n\nsyzbot demonstrated that the list_for_each_entry_safe() was not actually\nsafe in this case.\n\nA single skb could have references for multiple sockets.  If we free such\na skb in the list_for_each_entry_safe(), the current and next sockets could\nbe unlinked in a single iteration.\n\nunix_notinflight() uses list_del_init() to unlink the socket, so the\nprefetched next socket forms a loop itself and list_for_each_entry_safe()\nnever stops.\n\nHere, we must use while() and make sure we always fetch the first socket.\n\n[0]:\nSending NMI from CPU 0 to CPUs 1:\nNMI backtrace for cpu 1\nCPU: 1 PID: 5065 Comm: syz-executor236 Not tainted 6.8.0-rc3-syzkaller-00136-g1f719a2f3fa6 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024\nRIP: 0010:preempt_count arch/x86/include/asm/preempt.h:26 [inline]\nRIP: 0010:check_kcov_mode kernel/kcov.c:173 [inline]\nRIP: 0010:__sanitizer_cov_trace_pc+0xd/0x60 kernel/kcov.c:207\nCode: cc cc cc cc 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 65 48 8b 14 25 40 c2 03 00 \u003c65\u003e 8b 05 b4 7c 78 7e a9 00 01 ff 00 48 8b 34 24 74 0f f6 c4 01 74\nRSP: 0018:ffffc900033efa58 EFLAGS: 00000283\nRAX: ffff88807b077800 RBX: ffff88807b077800 RCX: 1ffffffff27b1189\nRDX: ffff88802a5a3b80 RSI: ffffffff8968488d RDI: ffff88807b077f70\nRBP: ffffc900033efbb0 R08: 0000000000000001 R09: fffffbfff27a900c\nR10: ffffffff93d48067 R11: ffffffff8ae000eb R12: ffff88807b077800\nR13: dffffc0000000000 R14: ffff88807b077e40 R15: 0000000000000001\nFS:  0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000564f4fc1e3a8 CR3: 000000000d57a000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cNMI\u003e\n \u003c/NMI\u003e\n \u003cTASK\u003e\n unix_gc+0x563/0x13b0 net/unix/garbage.c:319\n unix_release_sock+0xa93/0xf80 net/unix/af_unix.c:683\n unix_release+0x91/0xf0 net/unix/af_unix.c:1064\n __sock_release+0xb0/0x270 net/socket.c:659\n sock_close+0x1c/0x30 net/socket.c:1421\n __fput+0x270/0xb80 fs/file_table.c:376\n task_work_run+0x14f/0x250 kernel/task_work.c:180\n exit_task_work include/linux/task_work.h:38 [inline]\n do_exit+0xa8a/0x2ad0 kernel/exit.c:871\n do_group_exit+0xd4/0x2a0 kernel/exit.c:1020\n __do_sys_exit_group kernel/exit.c:1031 [inline]\n __se_sys_exit_group kernel/exit.c:1029 [inline]\n __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1029\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x6f/0x77\nRIP: 0033:0x7f9d6cbdac09\nCode: Unable to access opcode bytes at 0x7f9d6cbdabdf.\nRSP: 002b:00007fff5952feb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9d6cbdac09\nRDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000\nRBP: 00007f9d6cc552b0 R08: ffffffffffffffb8 R09: 0000000000000006\nR10: 0000000000000006 R11: 0000000000000246 R12: 00007f9d6cc552b0\nR13: 0000000000000000 R14: 00007f9d6cc55d00 R15: 00007f9d6cbabe70\n \u003c/TASK\u003e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:56:20.708Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/36f7371de977f805750748e80279be7e370df85c"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a3d40b4025fcfe51b04924979f1653993b17669"
        },
        {
          "url": "https://git.kernel.org/stable/c/69e0f04460f4037e01e29f0d9675544f62aafca3"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb8890318dde26fc89c6ea67d6e9070ab50b6e91"
        },
        {
          "url": "https://git.kernel.org/stable/c/25236c91b5ab4a26a56ba2e79b8060cf4e047839"
        }
      ],
      "title": "af_unix: Fix task hung while purging oob_skb in GC.",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26780",
    "datePublished": "2024-04-04T08:20:15.120Z",
    "dateReserved": "2024-02-19T14:20:24.177Z",
    "dateUpdated": "2025-05-04T08:56:20.708Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/36f7371de977f805750748e80279be7e370df85c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2a3d40b4025fcfe51b04924979f1653993b17669\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/69e0f04460f4037e01e29f0d9675544f62aafca3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/cb8890318dde26fc89c6ea67d6e9070ab50b6e91\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/25236c91b5ab4a26a56ba2e79b8060cf4e047839\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.403Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26780\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:51:08.468266Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:19.402Z\"}}], \"cna\": {\"title\": \"af_unix: Fix task hung while purging oob_skb in GC.\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4fe505c63aa3273135a57597fda761e9aecc7668\", \"lessThan\": \"36f7371de977f805750748e80279be7e370df85c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e0e09186d8821ad59806115d347ea32efa43ca4b\", \"lessThan\": \"2a3d40b4025fcfe51b04924979f1653993b17669\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b74aa9ce13d02b7fd37c5325b99854f91b9b4276\", \"lessThan\": \"69e0f04460f4037e01e29f0d9675544f62aafca3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"82ae47c5c3a6b27fdc0f9e83c1499cb439c56140\", \"lessThan\": \"cb8890318dde26fc89c6ea67d6e9070ab50b6e91\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1279f9d9dec2d7462823a18c29ad61359e0a007d\", \"lessThan\": \"25236c91b5ab4a26a56ba2e79b8060cf4e047839\", \"versionType\": \"git\"}], \"programFiles\": [\"net/unix/garbage.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.1.78\", \"lessThan\": \"6.1.81\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.6.17\", \"lessThan\": \"6.6.21\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.7.5\", \"lessThan\": \"6.7.9\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/unix/garbage.c\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/36f7371de977f805750748e80279be7e370df85c\"}, {\"url\": \"https://git.kernel.org/stable/c/2a3d40b4025fcfe51b04924979f1653993b17669\"}, {\"url\": \"https://git.kernel.org/stable/c/69e0f04460f4037e01e29f0d9675544f62aafca3\"}, {\"url\": \"https://git.kernel.org/stable/c/cb8890318dde26fc89c6ea67d6e9070ab50b6e91\"}, {\"url\": \"https://git.kernel.org/stable/c/25236c91b5ab4a26a56ba2e79b8060cf4e047839\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\naf_unix: Fix task hung while purging oob_skb in GC.\\n\\nsyzbot reported a task hung; at the same time, GC was looping infinitely\\nin list_for_each_entry_safe() for OOB skb.  [0]\\n\\nsyzbot demonstrated that the list_for_each_entry_safe() was not actually\\nsafe in this case.\\n\\nA single skb could have references for multiple sockets.  If we free such\\na skb in the list_for_each_entry_safe(), the current and next sockets could\\nbe unlinked in a single iteration.\\n\\nunix_notinflight() uses list_del_init() to unlink the socket, so the\\nprefetched next socket forms a loop itself and list_for_each_entry_safe()\\nnever stops.\\n\\nHere, we must use while() and make sure we always fetch the first socket.\\n\\n[0]:\\nSending NMI from CPU 0 to CPUs 1:\\nNMI backtrace for cpu 1\\nCPU: 1 PID: 5065 Comm: syz-executor236 Not tainted 6.8.0-rc3-syzkaller-00136-g1f719a2f3fa6 #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024\\nRIP: 0010:preempt_count arch/x86/include/asm/preempt.h:26 [inline]\\nRIP: 0010:check_kcov_mode kernel/kcov.c:173 [inline]\\nRIP: 0010:__sanitizer_cov_trace_pc+0xd/0x60 kernel/kcov.c:207\\nCode: cc cc cc cc 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 65 48 8b 14 25 40 c2 03 00 \u003c65\u003e 8b 05 b4 7c 78 7e a9 00 01 ff 00 48 8b 34 24 74 0f f6 c4 01 74\\nRSP: 0018:ffffc900033efa58 EFLAGS: 00000283\\nRAX: ffff88807b077800 RBX: ffff88807b077800 RCX: 1ffffffff27b1189\\nRDX: ffff88802a5a3b80 RSI: ffffffff8968488d RDI: ffff88807b077f70\\nRBP: ffffc900033efbb0 R08: 0000000000000001 R09: fffffbfff27a900c\\nR10: ffffffff93d48067 R11: ffffffff8ae000eb R12: ffff88807b077800\\nR13: dffffc0000000000 R14: ffff88807b077e40 R15: 0000000000000001\\nFS:  0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 0000564f4fc1e3a8 CR3: 000000000d57a000 CR4: 00000000003506f0\\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\nCall Trace:\\n \u003cNMI\u003e\\n \u003c/NMI\u003e\\n \u003cTASK\u003e\\n unix_gc+0x563/0x13b0 net/unix/garbage.c:319\\n unix_release_sock+0xa93/0xf80 net/unix/af_unix.c:683\\n unix_release+0x91/0xf0 net/unix/af_unix.c:1064\\n __sock_release+0xb0/0x270 net/socket.c:659\\n sock_close+0x1c/0x30 net/socket.c:1421\\n __fput+0x270/0xb80 fs/file_table.c:376\\n task_work_run+0x14f/0x250 kernel/task_work.c:180\\n exit_task_work include/linux/task_work.h:38 [inline]\\n do_exit+0xa8a/0x2ad0 kernel/exit.c:871\\n do_group_exit+0xd4/0x2a0 kernel/exit.c:1020\\n __do_sys_exit_group kernel/exit.c:1031 [inline]\\n __se_sys_exit_group kernel/exit.c:1029 [inline]\\n __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1029\\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83\\n entry_SYSCALL_64_after_hwframe+0x6f/0x77\\nRIP: 0033:0x7f9d6cbdac09\\nCode: Unable to access opcode bytes at 0x7f9d6cbdabdf.\\nRSP: 002b:00007fff5952feb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7\\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9d6cbdac09\\nRDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000\\nRBP: 00007f9d6cc552b0 R08: ffffffffffffffb8 R09: 0000000000000006\\nR10: 0000000000000006 R11: 0000000000000246 R12: 00007f9d6cc552b0\\nR13: 0000000000000000 R14: 00007f9d6cc55d00 R15: 00007f9d6cbabe70\\n \u003c/TASK\u003e\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.81\", \"versionStartIncluding\": \"6.1.78\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.21\", \"versionStartIncluding\": \"6.6.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.9\", \"versionStartIncluding\": \"6.7.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T08:56:20.708Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26780\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T08:56:20.708Z\", \"dateReserved\": \"2024-02-19T14:20:24.177Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-04T08:20:15.120Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.