Linux Kernel
CVE-2024-26712
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AC raised to High because exploitation requires both KASAN enabled (non-default) and an unaligned k_start at boot - conditions entirely beyond attacker control.
Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).
CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
powerpc/kasan: Fix addr error caused by page alignment
In kasan_init_region, when k_start is not page aligned, at the begin of for loop, k_cur = k_start & PAGE_MASK is less than k_start, and then va = block + k_cur - k_start is less than block, the addr va is invalid, because the memory address space from va to block is not alloced by memblock_alloc, which will not be reserved by memblock_reserve later, it will be used by other places.
As a result, memory overwriting occurs.
for example: int __init __weak kasan_init_region(void *start, size_t size) { [...] /* if say block(dcd97000) k_start(feef7400) k_end(feeff3fe) */ block = memblock_alloc(k_end - k_start, PAGE_SIZE); [...] for (k_cur = k_start & PAGE_MASK; k_cur < k_end; k_cur += PAGE_SIZE) { /* at the begin of for loop
- block(dcd97000) va(dcd96c00) k_cur(feef7000) k_start(feef7400)
- va(dcd96c00) is less than block(dcd97000), va is invalid
*/ void *va = block + k_cur - k_start; [...] } [...] }
Therefore, page alignment is performed on k_start before memblock_alloc() to ensure the validity of the VA address.
AnalysisAI
Memory corruption in the Linux kernel's PowerPC KASAN initialization routine permits local exploitation through an invalid virtual address calculation when the KASAN start address is not page-aligned at boot time. The pointer arithmetic error in kasan_init_region() causes writes to unallocated memory regions that have not been reserved by memblock_reserve, allowing corruption of kernel memory structures with potential for privilege escalation or denial of service on affected PowerPC systems. No public exploit has been identified and EPSS is low at 0.22% (13th percentile), though the CVSS score of 7.8 reflects the high intrinsic impact of kernel-level memory corruption.
Technical ContextAI
The flaw resides in kasan_init_region() within the Linux kernel's PowerPC KASAN (Kernel Address Sanitizer) subsystem. KASAN is a dynamic memory error detector that shadows kernel memory accesses to detect out-of-bounds reads and use-after-free conditions. The root cause is a pointer arithmetic error: when k_start is not page-aligned, the for loop begins at k_start & PAGE_MASK (rounded down to the previous page boundary), but the backing block was allocated only for the byte range [k_start, k_end). The expression va = block + k_cur - k_start produces a negative offset from block, yielding a pointer into memory that precedes the allocated region and is neither reserved by memblock_reserve nor under the control of this code path. The affected CPE is cpe:2.3:o:linux:linux_kernel:* covering multiple stable branches and explicitly including 6.8-rc1 through 6.8-rc4, along with Debian Linux 10.0. No CWE is formally assigned in NVD, but the defect is most closely analogous to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) via pointer arithmetic underflow.
RemediationAI
The primary fix is to upgrade to a patched Linux kernel version that includes the upstream correction ensuring k_start is page-aligned before the memblock_alloc() call. Six backported patch commits are available on the kernel stable tree, including 0516c06b19dc64807c10e01bb99b552bdf2d7dbe, 0c09912dd8387e228afcc5e34ac5d79b1e3a1058, 230e89b5ad0a33f530a2a976b3e5e4385cb27882, 2738e0aa2fb24a7ab9c878d912dc2b239738c6c6, 4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0, and 70ef2ba1f4286b2b73675aeb424b590c92d57b25, all at https://git.kernel.org/stable/. Debian 10 users should apply the security update referenced at https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html. As a compensating control on systems where kernel recompilation or update is not immediately possible, disabling CONFIG_KASAN in the kernel build configuration eliminates the vulnerable code path entirely, though this removes memory error detection capability and is only advisable on production systems where KASAN was already serving a non-critical role.
More in Debian Linux
View allApache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) o
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. Rated critical severity (
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today