Linux Kernel
CVE-2024-26655
MEDIUM
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
Fix memory leak in posix_clock_open()
If the clk ops.open() function returns an error, we don't release the pccontext we allocated for this clock.
Re-organize the code slightly to make it all more obvious.
AnalysisAI
A memory leak vulnerability exists in the Linux kernel's posix_clock_open() function where allocated pccontext memory is not properly released if the clock operations open() callback returns an error. This affects Linux kernel versions including 6.9-rc1 and potentially earlier releases across all architectures. An unprivileged local attacker with standard user privileges can trigger repeated failed clock open operations to exhaust kernel memory and cause denial of service, though the extremely low EPSS score of 0.01% indicates exploitation in the wild is unlikely despite the vulnerability being patched across multiple kernel versions.
Technical ContextAI
The vulnerability resides in the POSIX clock subsystem (posix-timers) of the Linux kernel, a core component responsible for managing clock-related system calls like clock_open(). The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime), a classic memory management error where dynamically allocated memory (pccontext structure) is not freed in all code paths. Specifically, when the posix_clock_open() function calls the clk->ops.open() callback and it fails, the function returns without deallocating the previously allocated pccontext pointer, causing kernel heap memory fragmentation and eventual exhaustion. The affected product is identified via CPE as Linux kernel (cpe:2.3:o:linux:linux_kernel) across all versions, with specific confirmation for version 6.9-rc1, indicating this is a pre-release discovery that was backported to stable kernels.
RemediationAI
Update the Linux kernel to a version that includes the posix_clock_open() memory leak fix by applying one of the available stable kernel patches from the vendor repository at https://git.kernel.org/stable/. The primary remediation is to pull the latest kernel version from your distribution (e.g., Ubuntu, Red Hat, Debian) that incorporates one of the seven listed patch commits. For systems unable to immediately patch, implement least-privilege access controls to restrict unprivileged user access to POSIX clock operations via seccomp or AppArmor/SELinux policies blocking the clock_open() or related system calls. Monitor kernel memory usage and watch for symptoms of memory exhaustion (page allocation failures, OOM killer invocations) in production systems. Prioritize this update with other routine kernel security patches rather than treating it as an emergency given the low EPSS score and lack of active exploitation evidence.
More in Linux Kernel
View allLinux kernel contains a flaw known as 'Dirty Pipe' where improper pipe buffer flag initialization allows unprivileged lo
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does no
The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate cer
The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial
Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. Rated high severity (CVSS 7.0). Public ex
The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr op
The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions when
The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allo
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cau
The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object ref
A remote code execution vulnerability in the Broadcom Wi-Fi firmware could enable a remote attacker to execute arbitrary
It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the h
Same weakness CWE-401 – Memory Leak
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today