CVE-2024-26712 (GCVE-0-2024-26712)

Vulnerability from cvelistv5 – Published: 2024-04-03 14:55 – Updated: 2026-08-05 11:26
VLAI
Title
powerpc/kasan: Fix addr error caused by page alignment
Summary
In the Linux kernel, the following vulnerability has been resolved: powerpc/kasan: Fix addr error caused by page alignment In kasan_init_region, when k_start is not page aligned, at the begin of for loop, k_cur = k_start & PAGE_MASK is less than k_start, and then `va = block + k_cur - k_start` is less than block, the addr va is invalid, because the memory address space from va to block is not alloced by memblock_alloc, which will not be reserved by memblock_reserve later, it will be used by other places. As a result, memory overwriting occurs. for example: int __init __weak kasan_init_region(void *start, size_t size) { [...] /* if say block(dcd97000) k_start(feef7400) k_end(feeff3fe) */ block = memblock_alloc(k_end - k_start, PAGE_SIZE); [...] for (k_cur = k_start & PAGE_MASK; k_cur < k_end; k_cur += PAGE_SIZE) { /* at the begin of for loop * block(dcd97000) va(dcd96c00) k_cur(feef7000) k_start(feef7400) * va(dcd96c00) is less than block(dcd97000), va is invalid */ void *va = block + k_cur - k_start; [...] } [...] } Therefore, page alignment is performed on k_start before memblock_alloc() to ensure the validity of the VA address.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 663c0c9496a69f80011205ba3194049bcafd681d , < 230e89b5ad0a33f530a2a976b3e5e4385cb27882 (git)
Affected: 663c0c9496a69f80011205ba3194049bcafd681d , < 2738e0aa2fb24a7ab9c878d912dc2b239738c6c6 (git)
Affected: 663c0c9496a69f80011205ba3194049bcafd681d , < 0c09912dd8387e228afcc5e34ac5d79b1e3a1058 (git)
Affected: 663c0c9496a69f80011205ba3194049bcafd681d , < 0516c06b19dc64807c10e01bb99b552bdf2d7dbe (git)
Affected: 663c0c9496a69f80011205ba3194049bcafd681d , < 70ef2ba1f4286b2b73675aeb424b590c92d57b25 (git)
Affected: 663c0c9496a69f80011205ba3194049bcafd681d , < 4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0 (git)
Affected: 5ce93076d8ee2a0fac3ad4adbd2e91b6197146db (git)
Affected: 5.3.6 , < 5.4 (semver)
Create a notification for this product.
Linux Linux Affected: 5.4
Unaffected: 0 , < 5.4 (semver)
Unaffected: 5.10.210 , ≤ 5.10.* (semver)
Unaffected: 5.15.149 , ≤ 5.15.* (semver)
Unaffected: 6.1.79 , ≤ 6.1.* (semver)
Unaffected: 6.6.18 , ≤ 6.6.* (semver)
Unaffected: 6.7.6 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 4.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-26712",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-04T15:22:01.316380Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-07T20:00:37.857Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:12.618Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/230e89b5ad0a33f530a2a976b3e5e4385cb27882"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2738e0aa2fb24a7ab9c878d912dc2b239738c6c6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0c09912dd8387e228afcc5e34ac5d79b1e3a1058"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0516c06b19dc64807c10e01bb99b552bdf2d7dbe"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/70ef2ba1f4286b2b73675aeb424b590c92d57b25"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/mm/kasan/init_32.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "230e89b5ad0a33f530a2a976b3e5e4385cb27882",
              "status": "affected",
              "version": "663c0c9496a69f80011205ba3194049bcafd681d",
              "versionType": "git"
            },
            {
              "lessThan": "2738e0aa2fb24a7ab9c878d912dc2b239738c6c6",
              "status": "affected",
              "version": "663c0c9496a69f80011205ba3194049bcafd681d",
              "versionType": "git"
            },
            {
              "lessThan": "0c09912dd8387e228afcc5e34ac5d79b1e3a1058",
              "status": "affected",
              "version": "663c0c9496a69f80011205ba3194049bcafd681d",
              "versionType": "git"
            },
            {
              "lessThan": "0516c06b19dc64807c10e01bb99b552bdf2d7dbe",
              "status": "affected",
              "version": "663c0c9496a69f80011205ba3194049bcafd681d",
              "versionType": "git"
            },
            {
              "lessThan": "70ef2ba1f4286b2b73675aeb424b590c92d57b25",
              "status": "affected",
              "version": "663c0c9496a69f80011205ba3194049bcafd681d",
              "versionType": "git"
            },
            {
              "lessThan": "4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0",
              "status": "affected",
              "version": "663c0c9496a69f80011205ba3194049bcafd681d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5ce93076d8ee2a0fac3ad4adbd2e91b6197146db",
              "versionType": "git"
            },
            {
              "lessThan": "5.4",
              "status": "affected",
              "version": "5.3.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/mm/kasan/init_32.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.210",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.149",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.79",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.18",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.6",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.3.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/kasan: Fix addr error caused by page alignment\n\nIn kasan_init_region, when k_start is not page aligned, at the begin of\nfor loop, k_cur = k_start \u0026 PAGE_MASK is less than k_start, and then\n`va = block + k_cur - k_start` is less than block, the addr va is invalid,\nbecause the memory address space from va to block is not alloced by\nmemblock_alloc, which will not be reserved by memblock_reserve later, it\nwill be used by other places.\n\nAs a result, memory overwriting occurs.\n\nfor example:\nint __init __weak kasan_init_region(void *start, size_t size)\n{\n[...]\n\t/* if say block(dcd97000) k_start(feef7400) k_end(feeff3fe) */\n\tblock = memblock_alloc(k_end - k_start, PAGE_SIZE);\n\t[...]\n\tfor (k_cur = k_start \u0026 PAGE_MASK; k_cur \u003c k_end; k_cur += PAGE_SIZE) {\n\t\t/* at the begin of for loop\n\t\t * block(dcd97000) va(dcd96c00) k_cur(feef7000) k_start(feef7400)\n\t\t * va(dcd96c00) is less than block(dcd97000), va is invalid\n\t\t */\n\t\tvoid *va = block + k_cur - k_start;\n\t\t[...]\n\t}\n[...]\n}\n\nTherefore, page alignment is performed on k_start before\nmemblock_alloc() to ensure the validity of the VA address."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is `__init`/boot-time PPC32 KASAN shadow setup with no network-facing entry point; the resulting aliased page is exercised only by local kernel activity (allocations, module loads) on the affected machine.\nAC:L - On a system that boots into the misaligned state, the corrupting writes are continuous and trivially driven \u2014 any ordinary allocation/free path writes KASAN shadow bytes into the co-owned page, requiring no special timing, race, or memory layout the attacker must win.\nPR:L - No elevated privilege is needed to drive the corruption; an unprivileged local process performing ordinary syscalls generates the kmalloc/kfree shadow poisoning that writes into the unreserved page, and running a KASAN kernel is a configuration precondition rather than a privilege the attacker exercises.\nUI:N - The bad shadow mapping is established autonomously during boot and the corruption proceeds without any victim action.\nS:U - Kernel memory corrupting other kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unreserved page is aliased into the KASAN shadow window while simultaneously being allocated to arbitrary consumers (page cache, slab, user pages), so contents of other security contexts are exposed through the shadow mapping and the uncontrolled corruption is leverageable for disclosure.\nI:H - This is out-of-bounds kernel writes into a page owned by unrelated code \u2014 the commit explicitly states \"memory overwriting occurs\" \u2014 corrupting live slab objects, page tables, or page cache, which is memory corruption exploitable for control-flow influence.\nA:H - Silent overwriting of randomly allocated pages, including potential page tables and slab metadata, reliably produces oopses and kernel panics."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:26:49.646Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/230e89b5ad0a33f530a2a976b3e5e4385cb27882"
        },
        {
          "url": "https://git.kernel.org/stable/c/2738e0aa2fb24a7ab9c878d912dc2b239738c6c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c09912dd8387e228afcc5e34ac5d79b1e3a1058"
        },
        {
          "url": "https://git.kernel.org/stable/c/0516c06b19dc64807c10e01bb99b552bdf2d7dbe"
        },
        {
          "url": "https://git.kernel.org/stable/c/70ef2ba1f4286b2b73675aeb424b590c92d57b25"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0"
        }
      ],
      "title": "powerpc/kasan: Fix addr error caused by page alignment",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26712",
    "datePublished": "2024-04-03T14:55:14.149Z",
    "dateReserved": "2024-02-19T14:20:24.159Z",
    "dateUpdated": "2026-08-05T11:26:49.646Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26712",
      "date": "2026-08-05",
      "epss": "0.00231",
      "percentile": "0.13977"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\npowerpc/kasan: Fix addr error caused by page alignment\\n\\nIn kasan_init_region, when k_start is not page aligned, at the begin of\\nfor loop, k_cur = k_start \u0026 PAGE_MASK is less than k_start, and then\\n`va = block + k_cur - k_start` is less than block, the addr va is invalid,\\nbecause the memory address space from va to block is not alloced by\\nmemblock_alloc, which will not be reserved by memblock_reserve later, it\\nwill be used by other places.\\n\\nAs a result, memory overwriting occurs.\\n\\nfor example:\\nint __init __weak kasan_init_region(void *start, size_t size)\\n{\\n[...]\\n\\t/* if say block(dcd97000) k_start(feef7400) k_end(feeff3fe) */\\n\\tblock = memblock_alloc(k_end - k_start, PAGE_SIZE);\\n\\t[...]\\n\\tfor (k_cur = k_start \u0026 PAGE_MASK; k_cur \u003c k_end; k_cur += PAGE_SIZE) {\\n\\t\\t/* at the begin of for loop\\n\\t\\t * block(dcd97000) va(dcd96c00) k_cur(feef7000) k_start(feef7400)\\n\\t\\t * va(dcd96c00) is less than block(dcd97000), va is invalid\\n\\t\\t */\\n\\t\\tvoid *va = block + k_cur - k_start;\\n\\t\\t[...]\\n\\t}\\n[...]\\n}\\n\\nTherefore, page alignment is performed on k_start before\\nmemblock_alloc() to ensure the validity of the VA address.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: powerpc/kasan: corrige el error de direcci\\u00f3n causado por la alineaci\\u00f3n de la p\\u00e1gina En kasan_init_region, cuando k_start no est\\u00e1 alineado con la p\\u00e1gina, al comienzo del bucle for, k_cur = k_start y PAGE_MASK es menor que k_start. y luego `va = block + k_cur - k_start` es menor que block, la direcci\\u00f3n va no es v\\u00e1lida, porque memblock_alloc no asigna el espacio de direcciones de memoria de va al bloque, que no ser\\u00e1 reservado por memblock_reserve m\\u00e1s adelante, se utilizar\\u00e1 por otros lugares. Como resultado, se produce una sobrescritura de la memoria. por ejemplo: int __init __weak kasan_init_region(void *start, size_t size) { [...] /* if say block(dcd97000) k_start(feef7400) k_end(feeff3fe) */ block = memblock_alloc(k_end - k_start, PAGE_SIZE); [...] for (k_cur = k_start \u0026amp; PAGE_MASK; k_cur \u0026lt; k_end; k_cur += PAGE_SIZE) { /* al comienzo del bucle for * block(dcd97000) va(dcd96c00) k_cur(feef7000) k_start(feef7400) * va (dcd96c00) es menor que block(dcd97000), va no es v\\u00e1lido */ void *va = block + k_cur - k_start; [...] } [...] } Por lo tanto, la alineaci\\u00f3n de la p\\u00e1gina se realiza en k_start antes de memblock_alloc() para garantizar la validez de la direcci\\u00f3n VA.\"}]",
      "id": "CVE-2024-26712",
      "lastModified": "2024-11-21T09:02:53.947",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 4.4, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 0.8, \"impactScore\": 3.6}]}",
      "published": "2024-04-03T15:15:53.590",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0516c06b19dc64807c10e01bb99b552bdf2d7dbe\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/0c09912dd8387e228afcc5e34ac5d79b1e3a1058\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/230e89b5ad0a33f530a2a976b3e5e4385cb27882\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/2738e0aa2fb24a7ab9c878d912dc2b239738c6c6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/70ef2ba1f4286b2b73675aeb424b590c92d57b25\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/0516c06b19dc64807c10e01bb99b552bdf2d7dbe\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/0c09912dd8387e228afcc5e34ac5d79b1e3a1058\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/230e89b5ad0a33f530a2a976b3e5e4385cb27882\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/2738e0aa2fb24a7ab9c878d912dc2b239738c6c6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/70ef2ba1f4286b2b73675aeb424b590c92d57b25\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26712\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-03T15:15:53.590\",\"lastModified\":\"2026-08-04T11:16:58.280\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\npowerpc/kasan: Fix addr error caused by page alignment\\n\\nIn kasan_init_region, when k_start is not page aligned, at the begin of\\nfor loop, k_cur = k_start \u0026 PAGE_MASK is less than k_start, and then\\n`va = block + k_cur - k_start` is less than block, the addr va is invalid,\\nbecause the memory address space from va to block is not alloced by\\nmemblock_alloc, which will not be reserved by memblock_reserve later, it\\nwill be used by other places.\\n\\nAs a result, memory overwriting occurs.\\n\\nfor example:\\nint __init __weak kasan_init_region(void *start, size_t size)\\n{\\n[...]\\n\\t/* if say block(dcd97000) k_start(feef7400) k_end(feeff3fe) */\\n\\tblock = memblock_alloc(k_end - k_start, PAGE_SIZE);\\n\\t[...]\\n\\tfor (k_cur = k_start \u0026 PAGE_MASK; k_cur \u003c k_end; k_cur += PAGE_SIZE) {\\n\\t\\t/* at the begin of for loop\\n\\t\\t * block(dcd97000) va(dcd96c00) k_cur(feef7000) k_start(feef7400)\\n\\t\\t * va(dcd96c00) is less than block(dcd97000), va is invalid\\n\\t\\t */\\n\\t\\tvoid *va = block + k_cur - k_start;\\n\\t\\t[...]\\n\\t}\\n[...]\\n}\\n\\nTherefore, page alignment is performed on k_start before\\nmemblock_alloc() to ensure the validity of the VA address.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: powerpc/kasan: corrige el error de direcci\u00f3n causado por la alineaci\u00f3n de la p\u00e1gina En kasan_init_region, cuando k_start no est\u00e1 alineado con la p\u00e1gina, al comienzo del bucle for, k_cur = k_start y PAGE_MASK es menor que k_start. y luego `va = block + k_cur - k_start` es menor que block, la direcci\u00f3n va no es v\u00e1lida, porque memblock_alloc no asigna el espacio de direcciones de memoria de va al bloque, que no ser\u00e1 reservado por memblock_reserve m\u00e1s adelante, se utilizar\u00e1 por otros lugares. Como resultado, se produce una sobrescritura de la memoria. por ejemplo: int __init __weak kasan_init_region(void *start, size_t size) { [...] /* if say block(dcd97000) k_start(feef7400) k_end(feeff3fe) */ block = memblock_alloc(k_end - k_start, PAGE_SIZE); [...] for (k_cur = k_start \u0026amp; PAGE_MASK; k_cur \u0026lt; k_end; k_cur += PAGE_SIZE) { /* al comienzo del bucle for * block(dcd97000) va(dcd96c00) k_cur(feef7000) k_start(feef7400) * va (dcd96c00) es menor que block(dcd97000), va no es v\u00e1lido */ void *va = block + k_cur - k_start; [...] } [...] } Por lo tanto, la alineaci\u00f3n de la p\u00e1gina se realiza en k_start antes de memblock_alloc() para garantizar la validez de la direcci\u00f3n VA.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/powerpc/mm/kasan/init_32.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"663c0c9496a69f80011205ba3194049bcafd681d\",\"lessThan\":\"230e89b5ad0a33f530a2a976b3e5e4385cb27882\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"663c0c9496a69f80011205ba3194049bcafd681d\",\"lessThan\":\"2738e0aa2fb24a7ab9c878d912dc2b239738c6c6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"663c0c9496a69f80011205ba3194049bcafd681d\",\"lessThan\":\"0c09912dd8387e228afcc5e34ac5d79b1e3a1058\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"663c0c9496a69f80011205ba3194049bcafd681d\",\"lessThan\":\"0516c06b19dc64807c10e01bb99b552bdf2d7dbe\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"663c0c9496a69f80011205ba3194049bcafd681d\",\"lessThan\":\"70ef2ba1f4286b2b73675aeb424b590c92d57b25\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"663c0c9496a69f80011205ba3194049bcafd681d\",\"lessThan\":\"4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5ce93076d8ee2a0fac3ad4adbd2e91b6197146db\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.3.6\",\"lessThan\":\"5.4\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/powerpc/mm/kasan/init_32.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.210\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.149\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.79\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.18\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.6\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-04-04T15:22:01.316380Z\",\"id\":\"CVE-2024-26712\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4\",\"versionEndExcluding\":\"5.10.210\",\"matchCriteriaId\":\"4A5E6646-6DCD-4074-85C2-F2050189051D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.149\",\"matchCriteriaId\":\"0D0465BB-4053-4E15-9137-6696EBAE90FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.79\",\"matchCriteriaId\":\"656E2F29-1779-4EFC-AA64-8F984E2885B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.18\",\"matchCriteriaId\":\"BD961E49-FEDA-47CF-BF23-4D2BD942B4E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.6\",\"matchCriteriaId\":\"C6D6A5C8-7308-42A9-8A72-ABF3DEA4BB82\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0516c06b19dc64807c10e01bb99b552bdf2d7dbe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0c09912dd8387e228afcc5e34ac5d79b1e3a1058\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/230e89b5ad0a33f530a2a976b3e5e4385cb27882\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2738e0aa2fb24a7ab9c878d912dc2b239738c6c6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/70ef2ba1f4286b2b73675aeb424b590c92d57b25\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0516c06b19dc64807c10e01bb99b552bdf2d7dbe\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0c09912dd8387e228afcc5e34ac5d79b1e3a1058\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/230e89b5ad0a33f530a2a976b3e5e4385cb27882\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2738e0aa2fb24a7ab9c878d912dc2b239738c6c6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/70ef2ba1f4286b2b73675aeb424b590c92d57b25\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:51:25+00:00",
      "cve": "CVE-2024-26712",
      "id": "CVE-2024-26712",
      "initial_release_date": "2024-04-03T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "98",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: powerpc/kasan: Fix addr error caused by page alignment",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26712.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-05T01:01:25Z",
      "cve": "CVE-2024-26712",
      "id": "CVE-2024-26712",
      "initial_release_date": "2024-04-09T02:29:09Z",
      "product_status:known_not_affected": "272",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26712",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26712.json",
      "version": "18"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/230e89b5ad0a33f530a2a976b3e5e4385cb27882\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2738e0aa2fb24a7ab9c878d912dc2b239738c6c6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0c09912dd8387e228afcc5e34ac5d79b1e3a1058\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0516c06b19dc64807c10e01bb99b552bdf2d7dbe\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/70ef2ba1f4286b2b73675aeb424b590c92d57b25\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:12.618Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.4, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26712\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-04T15:22:01.316380Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:21.993Z\"}}], \"cna\": {\"title\": \"powerpc/kasan: Fix addr error caused by page alignment\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is `__init`/boot-time PPC32 KASAN shadow setup with no network-facing entry point; the resulting aliased page is exercised only by local kernel activity (allocations, module loads) on the affected machine.\\nAC:L - On a system that boots into the misaligned state, the corrupting writes are continuous and trivially driven \\u2014 any ordinary allocation/free path writes KASAN shadow bytes into the co-owned page, requiring no special timing, race, or memory layout the attacker must win.\\nPR:L - No elevated privilege is needed to drive the corruption; an unprivileged local process performing ordinary syscalls generates the kmalloc/kfree shadow poisoning that writes into the unreserved page, and running a KASAN kernel is a configuration precondition rather than a privilege the attacker exercises.\\nUI:N - The bad shadow mapping is established autonomously during boot and the corruption proceeds without any victim action.\\nS:U - Kernel memory corrupting other kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The unreserved page is aliased into the KASAN shadow window while simultaneously being allocated to arbitrary consumers (page cache, slab, user pages), so contents of other security contexts are exposed through the shadow mapping and the uncontrolled corruption is leverageable for disclosure.\\nI:H - This is out-of-bounds kernel writes into a page owned by unrelated code \\u2014 the commit explicitly states \\\"memory overwriting occurs\\\" \\u2014 corrupting live slab objects, page tables, or page cache, which is memory corruption exploitable for control-flow influence.\\nA:H - Silent overwriting of randomly allocated pages, including potential page tables and slab metadata, reliably produces oopses and kernel panics.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"663c0c9496a69f80011205ba3194049bcafd681d\", \"lessThan\": \"230e89b5ad0a33f530a2a976b3e5e4385cb27882\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"663c0c9496a69f80011205ba3194049bcafd681d\", \"lessThan\": \"2738e0aa2fb24a7ab9c878d912dc2b239738c6c6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"663c0c9496a69f80011205ba3194049bcafd681d\", \"lessThan\": \"0c09912dd8387e228afcc5e34ac5d79b1e3a1058\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"663c0c9496a69f80011205ba3194049bcafd681d\", \"lessThan\": \"0516c06b19dc64807c10e01bb99b552bdf2d7dbe\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"663c0c9496a69f80011205ba3194049bcafd681d\", \"lessThan\": \"70ef2ba1f4286b2b73675aeb424b590c92d57b25\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"663c0c9496a69f80011205ba3194049bcafd681d\", \"lessThan\": \"4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5ce93076d8ee2a0fac3ad4adbd2e91b6197146db\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.3.6\", \"lessThan\": \"5.4\", \"versionType\": \"semver\"}], \"programFiles\": [\"arch/powerpc/mm/kasan/init_32.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.210\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.149\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.79\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.18\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/powerpc/mm/kasan/init_32.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/230e89b5ad0a33f530a2a976b3e5e4385cb27882\"}, {\"url\": \"https://git.kernel.org/stable/c/2738e0aa2fb24a7ab9c878d912dc2b239738c6c6\"}, {\"url\": \"https://git.kernel.org/stable/c/0c09912dd8387e228afcc5e34ac5d79b1e3a1058\"}, {\"url\": \"https://git.kernel.org/stable/c/0516c06b19dc64807c10e01bb99b552bdf2d7dbe\"}, {\"url\": \"https://git.kernel.org/stable/c/70ef2ba1f4286b2b73675aeb424b590c92d57b25\"}, {\"url\": \"https://git.kernel.org/stable/c/4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\npowerpc/kasan: Fix addr error caused by page alignment\\n\\nIn kasan_init_region, when k_start is not page aligned, at the begin of\\nfor loop, k_cur = k_start \u0026 PAGE_MASK is less than k_start, and then\\n`va = block + k_cur - k_start` is less than block, the addr va is invalid,\\nbecause the memory address space from va to block is not alloced by\\nmemblock_alloc, which will not be reserved by memblock_reserve later, it\\nwill be used by other places.\\n\\nAs a result, memory overwriting occurs.\\n\\nfor example:\\nint __init __weak kasan_init_region(void *start, size_t size)\\n{\\n[...]\\n\\t/* if say block(dcd97000) k_start(feef7400) k_end(feeff3fe) */\\n\\tblock = memblock_alloc(k_end - k_start, PAGE_SIZE);\\n\\t[...]\\n\\tfor (k_cur = k_start \u0026 PAGE_MASK; k_cur \u003c k_end; k_cur += PAGE_SIZE) {\\n\\t\\t/* at the begin of for loop\\n\\t\\t * block(dcd97000) va(dcd96c00) k_cur(feef7000) k_start(feef7400)\\n\\t\\t * va(dcd96c00) is less than block(dcd97000), va is invalid\\n\\t\\t */\\n\\t\\tvoid *va = block + k_cur - k_start;\\n\\t\\t[...]\\n\\t}\\n[...]\\n}\\n\\nTherefore, page alignment is performed on k_start before\\nmemblock_alloc() to ensure the validity of the VA address.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.210\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.149\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.79\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.18\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.6\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.3.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:26:49.646Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26712\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:26:49.646Z\", \"dateReserved\": \"2024-02-19T14:20:24.159Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-03T14:55:14.149Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.