CVE-2024-26795

CVE-2024-26795

High · published April 4, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
14.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

riscv: Sparse-Memory/vmemmap out-of-bounds fix

Offset vmemmap so that the first page of vmemmap will be mapped

to the first page of physical memory in order to ensure that

vmemmap’s bounds will be respected during

pfn_to_page()/page_to_pfn() operations.

The conversion macros will produce correct SV39/48/57 addresses

for every possible/valid DRAM_BASE inside the physical memory limits.

v2:Address Alex's comments

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00239 · 14.2th percentile
Published
2024-04-04T13:15Z
Affected products (12)
ProductVersionsFixed in
linux/linux_kernel≥ 5.4, < 5.10.2125.10.212
linux/linux_kernel≥ 5.11, < 5.15.1515.15.151
linux/linux_kernel≥ 5.16, < 6.1.816.1.81
linux/linux_kernel≥ 6.2, < 6.6.216.6.21
linux/linux_kernel≥ 6.7, < 6.7.96.7.9
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
debian/debian_linuxall versions—
References (12)
EPSS history
Timeline
  • 04 APR 08:20Z
    riscv: Sparse-Memory/vmemmap out-of-bounds fix
    cvelistv5