GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-26746 (GCVE-0-2024-26746)

Vulnerability from cvelistv5 – Published: 2024-04-04 08:20 – Updated: 2026-05-11 20:03
VLAI
Title
dmaengine: idxd: Ensure safe user copy of completion record
Summary
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Ensure safe user copy of completion record If CONFIG_HARDENED_USERCOPY is enabled, copying completion record from event log cache to user triggers a kernel bug. [ 1987.159822] usercopy: Kernel memory exposure attempt detected from SLUB object 'dsa0' (offset 74, size 31)! [ 1987.170845] ------------[ cut here ]------------ [ 1987.176086] kernel BUG at mm/usercopy.c:102! [ 1987.180946] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 1987.186866] CPU: 17 PID: 528 Comm: kworker/17:1 Not tainted 6.8.0-rc2+ #5 [ 1987.194537] Hardware name: Intel Corporation AvenueCity/AvenueCity, BIOS BHSDCRB1.86B.2492.D03.2307181620 07/18/2023 [ 1987.206405] Workqueue: wq0.0 idxd_evl_fault_work [idxd] [ 1987.212338] RIP: 0010:usercopy_abort+0x72/0x90 [ 1987.217381] Code: 58 65 9c 50 48 c7 c2 17 85 61 9c 57 48 c7 c7 98 fd 6b 9c 48 0f 44 d6 48 c7 c6 b3 08 62 9c 4c 89 d1 49 0f 44 f3 e8 1e 2e d5 ff <0f> 0b 49 c7 c1 9e 42 61 9c 4c 89 cf 4d 89 c8 eb a9 66 66 2e 0f 1f [ 1987.238505] RSP: 0018:ff62f5cf20607d60 EFLAGS: 00010246 [ 1987.244423] RAX: 000000000000005f RBX: 000000000000001f RCX: 0000000000000000 [ 1987.252480] RDX: 0000000000000000 RSI: ffffffff9c61429e RDI: 00000000ffffffff [ 1987.260538] RBP: ff62f5cf20607d78 R08: ff2a6a89ef3fffe8 R09: 00000000fffeffff [ 1987.268595] R10: ff2a6a89eed00000 R11: 0000000000000003 R12: ff2a66934849c89a [ 1987.276652] R13: 0000000000000001 R14: ff2a66934849c8b9 R15: ff2a66934849c899 [ 1987.284710] FS: 0000000000000000(0000) GS:ff2a66b22fe40000(0000) knlGS:0000000000000000 [ 1987.293850] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1987.300355] CR2: 00007fe291a37000 CR3: 000000010fbd4005 CR4: 0000000000f71ef0 [ 1987.308413] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1987.316470] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 1987.324527] PKRU: 55555554 [ 1987.327622] Call Trace: [ 1987.330424] <TASK> [ 1987.332826] ? show_regs+0x6e/0x80 [ 1987.336703] ? die+0x3c/0xa0 [ 1987.339988] ? do_trap+0xd4/0xf0 [ 1987.343662] ? do_error_trap+0x75/0xa0 [ 1987.347922] ? usercopy_abort+0x72/0x90 [ 1987.352277] ? exc_invalid_op+0x57/0x80 [ 1987.356634] ? usercopy_abort+0x72/0x90 [ 1987.360988] ? asm_exc_invalid_op+0x1f/0x30 [ 1987.365734] ? usercopy_abort+0x72/0x90 [ 1987.370088] __check_heap_object+0xb7/0xd0 [ 1987.374739] __check_object_size+0x175/0x2d0 [ 1987.379588] idxd_copy_cr+0xa9/0x130 [idxd] [ 1987.384341] idxd_evl_fault_work+0x127/0x390 [idxd] [ 1987.389878] process_one_work+0x13e/0x300 [ 1987.394435] ? __pfx_worker_thread+0x10/0x10 [ 1987.399284] worker_thread+0x2f7/0x420 [ 1987.403544] ? _raw_spin_unlock_irqrestore+0x2b/0x50 [ 1987.409171] ? __pfx_worker_thread+0x10/0x10 [ 1987.414019] kthread+0x107/0x140 [ 1987.417693] ? __pfx_kthread+0x10/0x10 [ 1987.421954] ret_from_fork+0x3d/0x60 [ 1987.426019] ? __pfx_kthread+0x10/0x10 [ 1987.430281] ret_from_fork_asm+0x1b/0x30 [ 1987.434744] </TASK> The issue arises because event log cache is created using kmem_cache_create() which is not suitable for user copy. Fix the issue by creating event log cache with kmem_cache_create_usercopy(), ensuring safe user copy.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-04 16:00 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c2f156bf168fb42cd6ecd0a8e2204dbe542b8516 , < 5e3022ea42e490a36ec6f2cfa6fc603deb0bace4 (git)
Affected: c2f156bf168fb42cd6ecd0a8e2204dbe542b8516 , < bb71e040323175e18c233a9afef32ba14fa64eb7 (git)
Affected: c2f156bf168fb42cd6ecd0a8e2204dbe542b8516 , < d3ea125df37dc37972d581b74a5d3785c3f283ab (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.6.21 , ≤ 6.6.* (semver)
Unaffected: 6.7.9 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26746",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-04T16:00:23.530084Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:48:37.499Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.241Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5e3022ea42e490a36ec6f2cfa6fc603deb0bace4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bb71e040323175e18c233a9afef32ba14fa64eb7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d3ea125df37dc37972d581b74a5d3785c3f283ab"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/idxd/init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5e3022ea42e490a36ec6f2cfa6fc603deb0bace4",
              "status": "affected",
              "version": "c2f156bf168fb42cd6ecd0a8e2204dbe542b8516",
              "versionType": "git"
            },
            {
              "lessThan": "bb71e040323175e18c233a9afef32ba14fa64eb7",
              "status": "affected",
              "version": "c2f156bf168fb42cd6ecd0a8e2204dbe542b8516",
              "versionType": "git"
            },
            {
              "lessThan": "d3ea125df37dc37972d581b74a5d3785c3f283ab",
              "status": "affected",
              "version": "c2f156bf168fb42cd6ecd0a8e2204dbe542b8516",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/idxd/init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.21",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.9",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Ensure safe user copy of completion record\n\nIf CONFIG_HARDENED_USERCOPY is enabled, copying completion record from\nevent log cache to user triggers a kernel bug.\n\n[ 1987.159822] usercopy: Kernel memory exposure attempt detected from SLUB object \u0027dsa0\u0027 (offset 74, size 31)!\n[ 1987.170845] ------------[ cut here ]------------\n[ 1987.176086] kernel BUG at mm/usercopy.c:102!\n[ 1987.180946] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\n[ 1987.186866] CPU: 17 PID: 528 Comm: kworker/17:1 Not tainted 6.8.0-rc2+ #5\n[ 1987.194537] Hardware name: Intel Corporation AvenueCity/AvenueCity, BIOS BHSDCRB1.86B.2492.D03.2307181620 07/18/2023\n[ 1987.206405] Workqueue: wq0.0 idxd_evl_fault_work [idxd]\n[ 1987.212338] RIP: 0010:usercopy_abort+0x72/0x90\n[ 1987.217381] Code: 58 65 9c 50 48 c7 c2 17 85 61 9c 57 48 c7 c7 98 fd 6b 9c 48 0f 44 d6 48 c7 c6 b3 08 62 9c 4c 89 d1 49 0f 44 f3 e8 1e 2e d5 ff \u003c0f\u003e 0b 49 c7 c1 9e 42 61 9c 4c 89 cf 4d 89 c8 eb a9 66 66 2e 0f 1f\n[ 1987.238505] RSP: 0018:ff62f5cf20607d60 EFLAGS: 00010246\n[ 1987.244423] RAX: 000000000000005f RBX: 000000000000001f RCX: 0000000000000000\n[ 1987.252480] RDX: 0000000000000000 RSI: ffffffff9c61429e RDI: 00000000ffffffff\n[ 1987.260538] RBP: ff62f5cf20607d78 R08: ff2a6a89ef3fffe8 R09: 00000000fffeffff\n[ 1987.268595] R10: ff2a6a89eed00000 R11: 0000000000000003 R12: ff2a66934849c89a\n[ 1987.276652] R13: 0000000000000001 R14: ff2a66934849c8b9 R15: ff2a66934849c899\n[ 1987.284710] FS:  0000000000000000(0000) GS:ff2a66b22fe40000(0000) knlGS:0000000000000000\n[ 1987.293850] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1987.300355] CR2: 00007fe291a37000 CR3: 000000010fbd4005 CR4: 0000000000f71ef0\n[ 1987.308413] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 1987.316470] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\n[ 1987.324527] PKRU: 55555554\n[ 1987.327622] Call Trace:\n[ 1987.330424]  \u003cTASK\u003e\n[ 1987.332826]  ? show_regs+0x6e/0x80\n[ 1987.336703]  ? die+0x3c/0xa0\n[ 1987.339988]  ? do_trap+0xd4/0xf0\n[ 1987.343662]  ? do_error_trap+0x75/0xa0\n[ 1987.347922]  ? usercopy_abort+0x72/0x90\n[ 1987.352277]  ? exc_invalid_op+0x57/0x80\n[ 1987.356634]  ? usercopy_abort+0x72/0x90\n[ 1987.360988]  ? asm_exc_invalid_op+0x1f/0x30\n[ 1987.365734]  ? usercopy_abort+0x72/0x90\n[ 1987.370088]  __check_heap_object+0xb7/0xd0\n[ 1987.374739]  __check_object_size+0x175/0x2d0\n[ 1987.379588]  idxd_copy_cr+0xa9/0x130 [idxd]\n[ 1987.384341]  idxd_evl_fault_work+0x127/0x390 [idxd]\n[ 1987.389878]  process_one_work+0x13e/0x300\n[ 1987.394435]  ? __pfx_worker_thread+0x10/0x10\n[ 1987.399284]  worker_thread+0x2f7/0x420\n[ 1987.403544]  ? _raw_spin_unlock_irqrestore+0x2b/0x50\n[ 1987.409171]  ? __pfx_worker_thread+0x10/0x10\n[ 1987.414019]  kthread+0x107/0x140\n[ 1987.417693]  ? __pfx_kthread+0x10/0x10\n[ 1987.421954]  ret_from_fork+0x3d/0x60\n[ 1987.426019]  ? __pfx_kthread+0x10/0x10\n[ 1987.430281]  ret_from_fork_asm+0x1b/0x30\n[ 1987.434744]  \u003c/TASK\u003e\n\nThe issue arises because event log cache is created using\nkmem_cache_create() which is not suitable for user copy.\n\nFix the issue by creating event log cache with\nkmem_cache_create_usercopy(), ensuring safe user copy."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:03:21.898Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5e3022ea42e490a36ec6f2cfa6fc603deb0bace4"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb71e040323175e18c233a9afef32ba14fa64eb7"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3ea125df37dc37972d581b74a5d3785c3f283ab"
        }
      ],
      "title": "dmaengine: idxd: Ensure safe user copy of completion record",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26746",
    "datePublished": "2024-04-04T08:20:13.846Z",
    "dateReserved": "2024-02-19T14:20:24.168Z",
    "dateUpdated": "2026-05-11T20:03:21.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26746",
      "date": "2026-09-16",
      "epss": "0.00225",
      "percentile": "0.13302"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndmaengine: idxd: Ensure safe user copy of completion record\\n\\nIf CONFIG_HARDENED_USERCOPY is enabled, copying completion record from\\nevent log cache to user triggers a kernel bug.\\n\\n[ 1987.159822] usercopy: Kernel memory exposure attempt detected from SLUB object \u0027dsa0\u0027 (offset 74, size 31)!\\n[ 1987.170845] ------------[ cut here ]------------\\n[ 1987.176086] kernel BUG at mm/usercopy.c:102!\\n[ 1987.180946] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\\n[ 1987.186866] CPU: 17 PID: 528 Comm: kworker/17:1 Not tainted 6.8.0-rc2+ #5\\n[ 1987.194537] Hardware name: Intel Corporation AvenueCity/AvenueCity, BIOS BHSDCRB1.86B.2492.D03.2307181620 07/18/2023\\n[ 1987.206405] Workqueue: wq0.0 idxd_evl_fault_work [idxd]\\n[ 1987.212338] RIP: 0010:usercopy_abort+0x72/0x90\\n[ 1987.217381] Code: 58 65 9c 50 48 c7 c2 17 85 61 9c 57 48 c7 c7 98 fd 6b 9c 48 0f 44 d6 48 c7 c6 b3 08 62 9c 4c 89 d1 49 0f 44 f3 e8 1e 2e d5 ff \u003c0f\u003e 0b 49 c7 c1 9e 42 61 9c 4c 89 cf 4d 89 c8 eb a9 66 66 2e 0f 1f\\n[ 1987.238505] RSP: 0018:ff62f5cf20607d60 EFLAGS: 00010246\\n[ 1987.244423] RAX: 000000000000005f RBX: 000000000000001f RCX: 0000000000000000\\n[ 1987.252480] RDX: 0000000000000000 RSI: ffffffff9c61429e RDI: 00000000ffffffff\\n[ 1987.260538] RBP: ff62f5cf20607d78 R08: ff2a6a89ef3fffe8 R09: 00000000fffeffff\\n[ 1987.268595] R10: ff2a6a89eed00000 R11: 0000000000000003 R12: ff2a66934849c89a\\n[ 1987.276652] R13: 0000000000000001 R14: ff2a66934849c8b9 R15: ff2a66934849c899\\n[ 1987.284710] FS:  0000000000000000(0000) GS:ff2a66b22fe40000(0000) knlGS:0000000000000000\\n[ 1987.293850] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[ 1987.300355] CR2: 00007fe291a37000 CR3: 000000010fbd4005 CR4: 0000000000f71ef0\\n[ 1987.308413] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n[ 1987.316470] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\\n[ 1987.324527] PKRU: 55555554\\n[ 1987.327622] Call Trace:\\n[ 1987.330424]  \u003cTASK\u003e\\n[ 1987.332826]  ? show_regs+0x6e/0x80\\n[ 1987.336703]  ? die+0x3c/0xa0\\n[ 1987.339988]  ? do_trap+0xd4/0xf0\\n[ 1987.343662]  ? do_error_trap+0x75/0xa0\\n[ 1987.347922]  ? usercopy_abort+0x72/0x90\\n[ 1987.352277]  ? exc_invalid_op+0x57/0x80\\n[ 1987.356634]  ? usercopy_abort+0x72/0x90\\n[ 1987.360988]  ? asm_exc_invalid_op+0x1f/0x30\\n[ 1987.365734]  ? usercopy_abort+0x72/0x90\\n[ 1987.370088]  __check_heap_object+0xb7/0xd0\\n[ 1987.374739]  __check_object_size+0x175/0x2d0\\n[ 1987.379588]  idxd_copy_cr+0xa9/0x130 [idxd]\\n[ 1987.384341]  idxd_evl_fault_work+0x127/0x390 [idxd]\\n[ 1987.389878]  process_one_work+0x13e/0x300\\n[ 1987.394435]  ? __pfx_worker_thread+0x10/0x10\\n[ 1987.399284]  worker_thread+0x2f7/0x420\\n[ 1987.403544]  ? _raw_spin_unlock_irqrestore+0x2b/0x50\\n[ 1987.409171]  ? __pfx_worker_thread+0x10/0x10\\n[ 1987.414019]  kthread+0x107/0x140\\n[ 1987.417693]  ? __pfx_kthread+0x10/0x10\\n[ 1987.421954]  ret_from_fork+0x3d/0x60\\n[ 1987.426019]  ? __pfx_kthread+0x10/0x10\\n[ 1987.430281]  ret_from_fork_asm+0x1b/0x30\\n[ 1987.434744]  \u003c/TASK\u003e\\n\\nThe issue arises because event log cache is created using\\nkmem_cache_create() which is not suitable for user copy.\\n\\nFix the issue by creating event log cache with\\nkmem_cache_create_usercopy(), ensuring safe user copy.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dmaengine: idxd: garantiza una copia segura del registro de finalizaci\\u00f3n para el usuario. Si CONFIG_HARDENED_USERCOPY est\\u00e1 habilitado, copiar el registro de finalizaci\\u00f3n desde la cach\\u00e9 del registro de eventos al usuario desencadena un error en el kernel. [ 1987.159822] usercopy: Kernel memory exposure attempt detected from SLUB object \u0027dsa0\u0027 (offset 74, size 31)! [ 1987.170845] ------------[ cut here ]------------ [ 1987.176086] kernel BUG at mm/usercopy.c:102! [ 1987.180946] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 1987.186866] CPU: 17 PID: 528 Comm: kworker/17:1 Not tainted 6.8.0-rc2+ #5 [ 1987.194537] Hardware name: Intel Corporation AvenueCity/AvenueCity, BIOS BHSDCRB1.86B.2492.D03.2307181620 07/18/2023 [ 1987.206405] Workqueue: wq0.0 idxd_evl_fault_work [idxd] [ 1987.212338] RIP: 0010:usercopy_abort+0x72/0x90 [ 1987.217381] Code: 58 65 9c 50 48 c7 c2 17 85 61 9c 57 48 c7 c7 98 fd 6b 9c 48 0f 44 d6 48 c7 c6 b3 08 62 9c 4c 89 d1 49 0f 44 f3 e8 1e 2e d5 ff \u0026lt;0f\u0026gt; 0b 49 c7 c1 9e 42 61 9c 4c 89 cf 4d 89 c8 eb a9 66 66 2e 0f 1f [ 1987.238505] RSP: 0018:ff62f5cf20607d60 EFLAGS: 00010246 [ 1987.244423] RAX: 000000000000005f RBX: 000000000000001f RCX: 0000000000000000 [ 1987.252480] RDX: 0000000000000000 RSI: ffffffff9c61429e RDI: 00000000ffffffff [ 1987.260538] RBP: ff62f5cf20607d78 R08: ff2a6a89ef3fffe8 R09: 00000000fffeffff [ 1987.268595] R10: ff2a6a89eed00000 R11: 0000000000000003 R12: ff2a66934849c89a [ 1987.276652] R13: 0000000000000001 R14: ff2a66934849c8b9 R15: ff2a66934849c899 [ 1987.284710] FS: 0000000000000000(0000) GS:ff2a66b22fe40000(0000) knlGS:0000000000000000 [ 1987.293850] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1987.300355] CR2: 00007fe291a37000 CR3: 000000010fbd4005 CR4: 0000000000f71ef0 [ 1987.308413] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1987.316470] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 1987.324527] PKRU: 55555554 [ 1987.327622] Call Trace: [ 1987.330424]  [ 1987.332826] ? show_regs+0x6e/0x80 [ 1987.336703] ? die+0x3c/0xa0 [ 1987.339988] ? do_trap+0xd4/0xf0 [ 1987.343662] ? do_error_trap+0x75/0xa0 [ 1987.347922] ? usercopy_abort+0x72/0x90 [ 1987.352277] ? exc_invalid_op+0x57/0x80 [ 1987.356634] ? usercopy_abort+0x72/0x90 [ 1987.360988] ? asm_exc_invalid_op+0x1f/0x30 [ 1987.365734] ? usercopy_abort+0x72/0x90 [ 1987.370088] __check_heap_object+0xb7/0xd0 [ 1987.374739] __check_object_size+0x175/0x2d0 [ 1987.379588] idxd_copy_cr+0xa9/0x130 [idxd] [ 1987.384341] idxd_evl_fault_work+0x127/0x390 [idxd] [ 1987.389878] process_one_work+0x13e/0x300 [ 1987.394435] ? __pfx_worker_thread+0x10/0x10 [ 1987.399284] worker_thread+0x2f7/0x420 [ 1987.403544] ? _raw_spin_unlock_irqrestore+0x2b/0x50 [ 1987.409171] ? __pfx_worker_thread+0x10/0x10 [ 1987.414019] kthread+0x107/0x140 [ 1987.417693] ? __pfx_kthread+0x10/0x10 [ 1987.421954] ret_from_fork+0x3d/0x60 [ 1987.426019] ? __pfx_kthread+0x10/0x10 [ 1987.430281] ret_from_fork_asm+0x1b/0x30 [ 1987.434744]  . El problema surge porque la cach\\u00e9 del registro de eventos se crea usando kmem_cache_create(), que no es adecuado para la copia del usuario. Solucione el problema creando un cach\\u00e9 de registro de eventos con kmem_cache_create_usercopy(), lo que garantiza una copia segura para el usuario.\"}]",
      "id": "CVE-2024-26746",
      "lastModified": "2024-11-21T09:02:58.613",
      "published": "2024-04-04T09:15:07.783",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/5e3022ea42e490a36ec6f2cfa6fc603deb0bace4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/bb71e040323175e18c233a9afef32ba14fa64eb7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d3ea125df37dc37972d581b74a5d3785c3f283ab\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/5e3022ea42e490a36ec6f2cfa6fc603deb0bace4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/bb71e040323175e18c233a9afef32ba14fa64eb7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/d3ea125df37dc37972d581b74a5d3785c3f283ab\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26746\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-04T09:15:07.783\",\"lastModified\":\"2026-06-17T07:18:14.377\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndmaengine: idxd: Ensure safe user copy of completion record\\n\\nIf CONFIG_HARDENED_USERCOPY is enabled, copying completion record from\\nevent log cache to user triggers a kernel bug.\\n\\n[ 1987.159822] usercopy: Kernel memory exposure attempt detected from SLUB object \u0027dsa0\u0027 (offset 74, size 31)!\\n[ 1987.170845] ------------[ cut here ]------------\\n[ 1987.176086] kernel BUG at mm/usercopy.c:102!\\n[ 1987.180946] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\\n[ 1987.186866] CPU: 17 PID: 528 Comm: kworker/17:1 Not tainted 6.8.0-rc2+ #5\\n[ 1987.194537] Hardware name: Intel Corporation AvenueCity/AvenueCity, BIOS BHSDCRB1.86B.2492.D03.2307181620 07/18/2023\\n[ 1987.206405] Workqueue: wq0.0 idxd_evl_fault_work [idxd]\\n[ 1987.212338] RIP: 0010:usercopy_abort+0x72/0x90\\n[ 1987.217381] Code: 58 65 9c 50 48 c7 c2 17 85 61 9c 57 48 c7 c7 98 fd 6b 9c 48 0f 44 d6 48 c7 c6 b3 08 62 9c 4c 89 d1 49 0f 44 f3 e8 1e 2e d5 ff \u003c0f\u003e 0b 49 c7 c1 9e 42 61 9c 4c 89 cf 4d 89 c8 eb a9 66 66 2e 0f 1f\\n[ 1987.238505] RSP: 0018:ff62f5cf20607d60 EFLAGS: 00010246\\n[ 1987.244423] RAX: 000000000000005f RBX: 000000000000001f RCX: 0000000000000000\\n[ 1987.252480] RDX: 0000000000000000 RSI: ffffffff9c61429e RDI: 00000000ffffffff\\n[ 1987.260538] RBP: ff62f5cf20607d78 R08: ff2a6a89ef3fffe8 R09: 00000000fffeffff\\n[ 1987.268595] R10: ff2a6a89eed00000 R11: 0000000000000003 R12: ff2a66934849c89a\\n[ 1987.276652] R13: 0000000000000001 R14: ff2a66934849c8b9 R15: ff2a66934849c899\\n[ 1987.284710] FS:  0000000000000000(0000) GS:ff2a66b22fe40000(0000) knlGS:0000000000000000\\n[ 1987.293850] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[ 1987.300355] CR2: 00007fe291a37000 CR3: 000000010fbd4005 CR4: 0000000000f71ef0\\n[ 1987.308413] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n[ 1987.316470] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\\n[ 1987.324527] PKRU: 55555554\\n[ 1987.327622] Call Trace:\\n[ 1987.330424]  \u003cTASK\u003e\\n[ 1987.332826]  ? show_regs+0x6e/0x80\\n[ 1987.336703]  ? die+0x3c/0xa0\\n[ 1987.339988]  ? do_trap+0xd4/0xf0\\n[ 1987.343662]  ? do_error_trap+0x75/0xa0\\n[ 1987.347922]  ? usercopy_abort+0x72/0x90\\n[ 1987.352277]  ? exc_invalid_op+0x57/0x80\\n[ 1987.356634]  ? usercopy_abort+0x72/0x90\\n[ 1987.360988]  ? asm_exc_invalid_op+0x1f/0x30\\n[ 1987.365734]  ? usercopy_abort+0x72/0x90\\n[ 1987.370088]  __check_heap_object+0xb7/0xd0\\n[ 1987.374739]  __check_object_size+0x175/0x2d0\\n[ 1987.379588]  idxd_copy_cr+0xa9/0x130 [idxd]\\n[ 1987.384341]  idxd_evl_fault_work+0x127/0x390 [idxd]\\n[ 1987.389878]  process_one_work+0x13e/0x300\\n[ 1987.394435]  ? __pfx_worker_thread+0x10/0x10\\n[ 1987.399284]  worker_thread+0x2f7/0x420\\n[ 1987.403544]  ? _raw_spin_unlock_irqrestore+0x2b/0x50\\n[ 1987.409171]  ? __pfx_worker_thread+0x10/0x10\\n[ 1987.414019]  kthread+0x107/0x140\\n[ 1987.417693]  ? __pfx_kthread+0x10/0x10\\n[ 1987.421954]  ret_from_fork+0x3d/0x60\\n[ 1987.426019]  ? __pfx_kthread+0x10/0x10\\n[ 1987.430281]  ret_from_fork_asm+0x1b/0x30\\n[ 1987.434744]  \u003c/TASK\u003e\\n\\nThe issue arises because event log cache is created using\\nkmem_cache_create() which is not suitable for user copy.\\n\\nFix the issue by creating event log cache with\\nkmem_cache_create_usercopy(), ensuring safe user copy.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dmaengine: idxd: garantiza una copia segura del registro de finalizaci\u00f3n para el usuario. Si CONFIG_HARDENED_USERCOPY est\u00e1 habilitado, copiar el registro de finalizaci\u00f3n desde la cach\u00e9 del registro de eventos al usuario desencadena un error en el kernel. [ 1987.159822] usercopy: Kernel memory exposure attempt detected from SLUB object \u0027dsa0\u0027 (offset 74, size 31)! [ 1987.170845] ------------[ cut here ]------------ [ 1987.176086] kernel BUG at mm/usercopy.c:102! [ 1987.180946] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 1987.186866] CPU: 17 PID: 528 Comm: kworker/17:1 Not tainted 6.8.0-rc2+ #5 [ 1987.194537] Hardware name: Intel Corporation AvenueCity/AvenueCity, BIOS BHSDCRB1.86B.2492.D03.2307181620 07/18/2023 [ 1987.206405] Workqueue: wq0.0 idxd_evl_fault_work [idxd] [ 1987.212338] RIP: 0010:usercopy_abort+0x72/0x90 [ 1987.217381] Code: 58 65 9c 50 48 c7 c2 17 85 61 9c 57 48 c7 c7 98 fd 6b 9c 48 0f 44 d6 48 c7 c6 b3 08 62 9c 4c 89 d1 49 0f 44 f3 e8 1e 2e d5 ff \u0026lt;0f\u0026gt; 0b 49 c7 c1 9e 42 61 9c 4c 89 cf 4d 89 c8 eb a9 66 66 2e 0f 1f [ 1987.238505] RSP: 0018:ff62f5cf20607d60 EFLAGS: 00010246 [ 1987.244423] RAX: 000000000000005f RBX: 000000000000001f RCX: 0000000000000000 [ 1987.252480] RDX: 0000000000000000 RSI: ffffffff9c61429e RDI: 00000000ffffffff [ 1987.260538] RBP: ff62f5cf20607d78 R08: ff2a6a89ef3fffe8 R09: 00000000fffeffff [ 1987.268595] R10: ff2a6a89eed00000 R11: 0000000000000003 R12: ff2a66934849c89a [ 1987.276652] R13: 0000000000000001 R14: ff2a66934849c8b9 R15: ff2a66934849c899 [ 1987.284710] FS: 0000000000000000(0000) GS:ff2a66b22fe40000(0000) knlGS:0000000000000000 [ 1987.293850] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1987.300355] CR2: 00007fe291a37000 CR3: 000000010fbd4005 CR4: 0000000000f71ef0 [ 1987.308413] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1987.316470] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 1987.324527] PKRU: 55555554 [ 1987.327622] Call Trace: [ 1987.330424]  [ 1987.332826] ? show_regs+0x6e/0x80 [ 1987.336703] ? die+0x3c/0xa0 [ 1987.339988] ? do_trap+0xd4/0xf0 [ 1987.343662] ? do_error_trap+0x75/0xa0 [ 1987.347922] ? usercopy_abort+0x72/0x90 [ 1987.352277] ? exc_invalid_op+0x57/0x80 [ 1987.356634] ? usercopy_abort+0x72/0x90 [ 1987.360988] ? asm_exc_invalid_op+0x1f/0x30 [ 1987.365734] ? usercopy_abort+0x72/0x90 [ 1987.370088] __check_heap_object+0xb7/0xd0 [ 1987.374739] __check_object_size+0x175/0x2d0 [ 1987.379588] idxd_copy_cr+0xa9/0x130 [idxd] [ 1987.384341] idxd_evl_fault_work+0x127/0x390 [idxd] [ 1987.389878] process_one_work+0x13e/0x300 [ 1987.394435] ? __pfx_worker_thread+0x10/0x10 [ 1987.399284] worker_thread+0x2f7/0x420 [ 1987.403544] ? _raw_spin_unlock_irqrestore+0x2b/0x50 [ 1987.409171] ? __pfx_worker_thread+0x10/0x10 [ 1987.414019] kthread+0x107/0x140 [ 1987.417693] ? __pfx_kthread+0x10/0x10 [ 1987.421954] ret_from_fork+0x3d/0x60 [ 1987.426019] ? __pfx_kthread+0x10/0x10 [ 1987.430281] ret_from_fork_asm+0x1b/0x30 [ 1987.434744]  . El problema surge porque la cach\u00e9 del registro de eventos se crea usando kmem_cache_create(), que no es adecuado para la copia del usuario. Solucione el problema creando un cach\u00e9 de registro de eventos con kmem_cache_create_usercopy(), lo que garantiza una copia segura para el usuario.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/dma/idxd/init.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c2f156bf168fb42cd6ecd0a8e2204dbe542b8516\",\"lessThan\":\"5e3022ea42e490a36ec6f2cfa6fc603deb0bace4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c2f156bf168fb42cd6ecd0a8e2204dbe542b8516\",\"lessThan\":\"bb71e040323175e18c233a9afef32ba14fa64eb7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c2f156bf168fb42cd6ecd0a8e2204dbe542b8516\",\"lessThan\":\"d3ea125df37dc37972d581b74a5d3785c3f283ab\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/dma/idxd/init.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.21\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.9\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-04-04T16:00:23.530084Z\",\"id\":\"CVE-2024-26746\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4\",\"versionEndExcluding\":\"6.6.21\",\"matchCriteriaId\":\"584D76D2-1164-4D5F-A720-182A249B363A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.9\",\"matchCriteriaId\":\"1C538467-EDA0-4A9A-82EB-2925DE9FF827\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"A780F817-2A77-4130-A9B7-5C25606314E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"AEB9199B-AB8F-4877-8964-E2BA95B5F15C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5e3022ea42e490a36ec6f2cfa6fc603deb0bace4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bb71e040323175e18c233a9afef32ba14fa64eb7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d3ea125df37dc37972d581b74a5d3785c3f283ab\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5e3022ea42e490a36ec6f2cfa6fc603deb0bace4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bb71e040323175e18c233a9afef32ba14fa64eb7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d3ea125df37dc37972d581b74a5d3785c3f283ab\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-28T07:49:47+00:00",
      "cve": "CVE-2024-26746",
      "id": "CVE-2024-26746",
      "initial_release_date": "2024-04-04T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "98",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: dmaengine: idxd: Ensure safe user copy of completion record",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26746.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:58:30Z",
      "cve": "CVE-2024-26746",
      "id": "CVE-2024-26746",
      "initial_release_date": "2024-04-09T02:29:04Z",
      "product_status:known_not_affected": "364",
      "product_status:recommended": "202",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26746",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26746.json",
      "version": "35"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5e3022ea42e490a36ec6f2cfa6fc603deb0bace4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/bb71e040323175e18c233a9afef32ba14fa64eb7\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d3ea125df37dc37972d581b74a5d3785c3f283ab\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.241Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26746\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-04T16:00:23.530084Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:22.084Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"dmaengine: idxd: Ensure safe user copy of completion record\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c2f156bf168fb42cd6ecd0a8e2204dbe542b8516\", \"lessThan\": \"5e3022ea42e490a36ec6f2cfa6fc603deb0bace4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c2f156bf168fb42cd6ecd0a8e2204dbe542b8516\", \"lessThan\": \"bb71e040323175e18c233a9afef32ba14fa64eb7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c2f156bf168fb42cd6ecd0a8e2204dbe542b8516\", \"lessThan\": \"d3ea125df37dc37972d581b74a5d3785c3f283ab\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/dma/idxd/init.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.21\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/dma/idxd/init.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5e3022ea42e490a36ec6f2cfa6fc603deb0bace4\"}, {\"url\": \"https://git.kernel.org/stable/c/bb71e040323175e18c233a9afef32ba14fa64eb7\"}, {\"url\": \"https://git.kernel.org/stable/c/d3ea125df37dc37972d581b74a5d3785c3f283ab\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndmaengine: idxd: Ensure safe user copy of completion record\\n\\nIf CONFIG_HARDENED_USERCOPY is enabled, copying completion record from\\nevent log cache to user triggers a kernel bug.\\n\\n[ 1987.159822] usercopy: Kernel memory exposure attempt detected from SLUB object \u0027dsa0\u0027 (offset 74, size 31)!\\n[ 1987.170845] ------------[ cut here ]------------\\n[ 1987.176086] kernel BUG at mm/usercopy.c:102!\\n[ 1987.180946] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\\n[ 1987.186866] CPU: 17 PID: 528 Comm: kworker/17:1 Not tainted 6.8.0-rc2+ #5\\n[ 1987.194537] Hardware name: Intel Corporation AvenueCity/AvenueCity, BIOS BHSDCRB1.86B.2492.D03.2307181620 07/18/2023\\n[ 1987.206405] Workqueue: wq0.0 idxd_evl_fault_work [idxd]\\n[ 1987.212338] RIP: 0010:usercopy_abort+0x72/0x90\\n[ 1987.217381] Code: 58 65 9c 50 48 c7 c2 17 85 61 9c 57 48 c7 c7 98 fd 6b 9c 48 0f 44 d6 48 c7 c6 b3 08 62 9c 4c 89 d1 49 0f 44 f3 e8 1e 2e d5 ff \u003c0f\u003e 0b 49 c7 c1 9e 42 61 9c 4c 89 cf 4d 89 c8 eb a9 66 66 2e 0f 1f\\n[ 1987.238505] RSP: 0018:ff62f5cf20607d60 EFLAGS: 00010246\\n[ 1987.244423] RAX: 000000000000005f RBX: 000000000000001f RCX: 0000000000000000\\n[ 1987.252480] RDX: 0000000000000000 RSI: ffffffff9c61429e RDI: 00000000ffffffff\\n[ 1987.260538] RBP: ff62f5cf20607d78 R08: ff2a6a89ef3fffe8 R09: 00000000fffeffff\\n[ 1987.268595] R10: ff2a6a89eed00000 R11: 0000000000000003 R12: ff2a66934849c89a\\n[ 1987.276652] R13: 0000000000000001 R14: ff2a66934849c8b9 R15: ff2a66934849c899\\n[ 1987.284710] FS:  0000000000000000(0000) GS:ff2a66b22fe40000(0000) knlGS:0000000000000000\\n[ 1987.293850] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[ 1987.300355] CR2: 00007fe291a37000 CR3: 000000010fbd4005 CR4: 0000000000f71ef0\\n[ 1987.308413] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n[ 1987.316470] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\\n[ 1987.324527] PKRU: 55555554\\n[ 1987.327622] Call Trace:\\n[ 1987.330424]  \u003cTASK\u003e\\n[ 1987.332826]  ? show_regs+0x6e/0x80\\n[ 1987.336703]  ? die+0x3c/0xa0\\n[ 1987.339988]  ? do_trap+0xd4/0xf0\\n[ 1987.343662]  ? do_error_trap+0x75/0xa0\\n[ 1987.347922]  ? usercopy_abort+0x72/0x90\\n[ 1987.352277]  ? exc_invalid_op+0x57/0x80\\n[ 1987.356634]  ? usercopy_abort+0x72/0x90\\n[ 1987.360988]  ? asm_exc_invalid_op+0x1f/0x30\\n[ 1987.365734]  ? usercopy_abort+0x72/0x90\\n[ 1987.370088]  __check_heap_object+0xb7/0xd0\\n[ 1987.374739]  __check_object_size+0x175/0x2d0\\n[ 1987.379588]  idxd_copy_cr+0xa9/0x130 [idxd]\\n[ 1987.384341]  idxd_evl_fault_work+0x127/0x390 [idxd]\\n[ 1987.389878]  process_one_work+0x13e/0x300\\n[ 1987.394435]  ? __pfx_worker_thread+0x10/0x10\\n[ 1987.399284]  worker_thread+0x2f7/0x420\\n[ 1987.403544]  ? _raw_spin_unlock_irqrestore+0x2b/0x50\\n[ 1987.409171]  ? __pfx_worker_thread+0x10/0x10\\n[ 1987.414019]  kthread+0x107/0x140\\n[ 1987.417693]  ? __pfx_kthread+0x10/0x10\\n[ 1987.421954]  ret_from_fork+0x3d/0x60\\n[ 1987.426019]  ? __pfx_kthread+0x10/0x10\\n[ 1987.430281]  ret_from_fork_asm+0x1b/0x30\\n[ 1987.434744]  \u003c/TASK\u003e\\n\\nThe issue arises because event log cache is created using\\nkmem_cache_create() which is not suitable for user copy.\\n\\nFix the issue by creating event log cache with\\nkmem_cache_create_usercopy(), ensuring safe user copy.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.21\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.9\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"6.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:03:21.898Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26746\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:03:21.898Z\", \"dateReserved\": \"2024-02-19T14:20:24.168Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-04T08:20:13.846Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.