PT-2024-7727 · Linux+2 · Linux Kernel+2

Tony Zhu · Published 2024-02-19 · Updated 2025-09-29 · CVE-2024-26746

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.8.0-rc2+

Description The issue arises because the event log cache is created using kmem cache create(), which is not suitable for user copy. When CONFIG HARDENED USERCOPY is enabled, copying the completion record from the event log cache to the user triggers a kernel bug. This can lead to a kernel memory exposure attempt, causing the kernel to crash. The fix involves creating the event log cache with kmem cache create usercopy(), ensuring safe user copy.

Recommendations To resolve the issue, create the event log cache with kmem cache create usercopy() instead of kmem cache create(), ensuring safe user copy. This change will prevent the kernel bug from occurring when CONFIG HARDENED USERCOPY is enabled.

Exploit

Fix

Weakness Enumeration

CWE-399

Related Identifiers

ALSA-2025_12746

ALSA-2025_12752

ALSA-2025_12753

ALSA-2025_16880

BDU:2024-09192

CVE-2024-26746

INFSA-2024_9315

RHSA-2024:9315

RHSA-2024_9315

Affected Products

Linux Kernel

Red Hat

Red Os

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26746.json · Exploit
• https://git.kernel.org/stable/c/5e3022ea42e490a36ec6f2cfa6fc603deb0bace4 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-26746 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-12682.html · Vendor Advisory
• https://git.kernel.org/stable/c/d3ea125df37dc37972d581b74a5d3785c3f283ab · Patch
• https://linux.oracle.com/errata/ELSA-2024-9315.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09192 · Security Note
• https://git.kernel.org/stable/c/bb71e040323175e18c233a9afef32ba14fa64eb7 · Patch
• https://ubuntu.com/security/CVE-2024-26746 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-26746 · Security Note
• https://osv.dev/vulnerability/CVE-2024-26746 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2024-26746 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-26746 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26746 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-26746 · Vendor Advisory