CVE-2024-26824

CVE-2024-26824

High · published April 17, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
13.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

crypto: algif_hash - Remove bogus SGL free on zero-length error path

When a zero-length message is hashed by algif_hash, and an error

is triggered, it tries to free an SG list that was never allocated

in the first place. Fix this by not freeing the SG list on the

zero-length error path.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00237 · 13.9th percentile
Published
2024-04-17T14:15Z
Affected products (5)
ProductVersionsFixed in
linux/linux_kernel≥ 6.5, < 6.6.186.6.18
linux/linux_kernel≥ 6.7, < 6.7.66.7.6
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (6)
https://git.kernel.org/stable/c/24c890dd712f6345e382256cae8c97abb0406b70 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/775f3c1882a493168e08fdb8cde0865c8f3a8a29 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9c82920359b7c1eddaf72069bcfe0ffddf088cd0 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/24c890dd712f6345e382256cae8c97abb0406b70 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/775f3c1882a493168e08fdb8cde0865c8f3a8a29 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/9c82920359b7c1eddaf72069bcfe0ffddf088cd0 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 17 APR 09:43Z
    crypto: algif_hash - Remove bogus SGL free on zero-length error path
    cvelistv5