CVE-2024-26655
MEDIUMCVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
Fix memory leak in posix_clock_open()
If the clk ops.open() function returns an error, we don't release the pccontext we allocated for this clock.
Re-organize the code slightly to make it all more obvious.
AnalysisAI
A memory leak vulnerability exists in the Linux kernel's posix_clock_open() function where allocated pccontext memory is not properly released if the clock operations open() callback returns an error. This affects Linux kernel versions including 6.9-rc1 and potentially earlier releases across all architectures. An unprivileged local attacker with standard user privileges can trigger repeated failed clock open operations to exhaust kernel memory and cause denial of service, though the extremely low EPSS score of 0.01% indicates exploitation in the wild is unlikely despite the vulnerability being patched across multiple kernel versions.
Technical ContextAI
The vulnerability resides in the POSIX clock subsystem (posix-timers) of the Linux kernel, a core component responsible for managing clock-related system calls like clock_open(). The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime), a classic memory management error where dynamically allocated memory (pccontext structure) is not freed in all code paths. Specifically, when the posix_clock_open() function calls the clk->ops.open() callback and it fails, the function returns without deallocating the previously allocated pccontext pointer, causing kernel heap memory fragmentation and eventual exhaustion. The affected product is identified via CPE as Linux kernel (cpe:2.3:o:linux:linux_kernel) across all versions, with specific confirmation for version 6.9-rc1, indicating this is a pre-release discovery that was backported to stable kernels.
RemediationAI
Update the Linux kernel to a version that includes the posix_clock_open() memory leak fix by applying one of the available stable kernel patches from the vendor repository at https://git.kernel.org/stable/. The primary remediation is to pull the latest kernel version from your distribution (e.g., Ubuntu, Red Hat, Debian) that incorporates one of the seven listed patch commits. For systems unable to immediately patch, implement least-privilege access controls to restrict unprivileged user access to POSIX clock operations via seccomp or AppArmor/SELinux policies blocking the clock_open() or related system calls. Monitor kernel memory usage and watch for symptoms of memory exhaustion (page allocation failures, OOM killer invocations) in production systems. Prioritize this update with other routine kernel security patches rather than treating it as an emergency given the low EPSS score and lack of active exploitation evidence.
Share
External POC / Exploit Code
Leaving vuln.today