PT-2024-21507 · Linux+1 · Linux Kernel+1

Published 2024-02-06 · Updated 2026-03-13 · CVE-2024-26768

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.8.0-rc2+

Description The issue is related to the LoongArch architecture in the Linux kernel. When the hardware platform has more than 64 CPUs, the system will crash due to an array overflow when parsing the MADT table. The array acpi core pic[NR CPUS] can be overflowed, causing the system to crash. The patch changes the array to acpi core pic[MAX CORE PIC], which is the maximum CPU number in the MADT table. This change allows the system to boot up 64 vcpus with the qemu parameter -smp 128 without crashing.

Recommendations To resolve the issue, update the Linux kernel to a version that includes the patch, which is version 6.8.0-rc2+ or later.

Note: The provided information does not include any details about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. Therefore, these points are omitted from the description.

Exploit

Fix

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-120

Related Identifiers

BDU:2025-03587

CVE-2024-26768

ECHO-4354-C819-BC58

Affected Products

Debian

Linux Kernel

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26768.json · Exploit
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2024-26768 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-26768 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-26768 · Vendor Advisory
• https://git.kernel.org/stable/c/88e189bd16e5889e44a41b3309558ebab78b9280 · Patch
• https://git.kernel.org/stable/c/0f6810e39898af2d2cabd9313e4dbc945fb5dfdd · Patch
• https://cve.org/CVERecord?id=CVE-2024-26768 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-26768 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-26768 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26768 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26768 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2024-26768 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03587 · Security Note
• https://git.kernel.org/stable/c/4551b30525cf3d2f026b92401ffe241eb04dfebe · Patch
• https://docs.bell-sw.com/security/cves/CVE-2024-26768 · Note