PT-2024-1950 · Linux+5 · Linux Kernel+5
Published
2024-01-31
·
Updated
2025-09-29
·
CVE-2024-26606
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to the binder functionality in the Linux kernel. In (e)poll mode, threads depend on I/O events to determine when data is ready for consumption. A thread may initiate a command via BINDER WRITE READ without a read buffer and then use epoll wait() or similar to consume any responses afterwards. It is crucial that epoll threads are signaled via wakeup when they queue their own work. Otherwise, they risk waiting indefinitely for an event leaving their work unhandled. What is worse, subsequent commands won't trigger a wakeup either as the thread has pending work. The vulnerability is associated with uncontrolled resource consumption, which can be exploited by a remote attacker to cause a denial of service.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Resource Exhaustion
Improper Resource Release
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Red Os
Ubuntu