PT-2024-21455 · Linux+2 · Linux Kernel+2

Mike Beaton · Published 2024-04-02 · Updated 2025-09-29 · CVE-2024-26678

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the x86/efistub in the Linux kernel, where the .compat section, a dummy PE section containing the address of the 32-bit entrypoint of the 64-bit kernel image, is placed at the end of the memory view of the image. This placement violates the PE/COFF spec, as it does not follow a monotonically increasing manner without leaving gaps, which can cause some PE loaders to reject the images. The Tianocore reference implementation and most EFI loaders will work correctly, but reorganizing the sections is necessary to avoid this issue, resulting in a slight padding overhead that can be avoided by disabling CONFIG EFI MIXED.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALSA-2025_12746

ALSA-2025_12752

ALSA-2025_12753

ALSA-2025_16880

CVE-2024-26678

INFSA-2024_9315

RHSA-2024:9315

RHSA-2024_9315

Affected Products

Linux Kernel

Red Hat

Red Os

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26678.json · Exploit
• https://git.kernel.org/stable/c/1ad55cecf22f05f1c884adf63cc09d3c3e609ebf · Patch
• https://security-tracker.debian.org/tracker/CVE-2024-26678 · Vendor Advisory
• https://git.kernel.org/stable/c/d327e961573fc335af0ae8a160302205327e1f4e · Patch
• https://git.kernel.org/stable/c/4adeeff8c12321cd453412a659c3c0eeb9bb2397 · Patch
• https://ubuntu.com/security/CVE-2024-26678 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-26678 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26678 · Security Note
• https://osv.dev/vulnerability/CVE-2024-26678 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-26678 · Security Note
• https://linux.oracle.com/errata/ELSA-2024-9315.html · Vendor Advisory
• https://git.kernel.org/stable/c/0a962f2fbaa976af9eed21d0306370cded485787 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-26678 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2024-26678 · Vendor Advisory
• https://docs.bell-sw.com/security/cves/CVE-2024-26678 · Note