CVE-2024-26606: binder: signal epoll threads of self-work
In the Linux kernel, the following vulnerability has been resolved:
binder: signal epoll threads of self-work
In (e)poll mode, threads often depend on I/O events to determine when data is ready for consumption. Within binder, a thread may initiate a command via BINDERWRITEREAD without a read buffer and then make use of epollwait() or similar to consume any responses afterwards.
It is then crucial that epoll threads are signaled via wakeup when they queue their own work. Otherwise, they risk waiting indefinitely for an event leaving their work unhandled. What is worse, subsequent commands won't trigger a wakeup either as the thread has pending work.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26606?
CVE-2024-26606 has been classified with a high severity due to its impact on the Linux kernel's binder component.
Which versions of the Linux kernel are affected by CVE-2024-26606?
CVE-2024-26606 affects various versions of the Linux kernel from 2.6.29 to 6.7.0.
How do I fix CVE-2024-26606?
To fix CVE-2024-26606, update your Linux kernel to the patched versions such as 5.10.223-1, 5.10.226-1, or newer.
What component of the Linux kernel is impacted by CVE-2024-26606?
CVE-2024-26606 impacts the binder component of the Linux kernel.
Is CVE-2024-26606 a remote code execution vulnerability?
No, CVE-2024-26606 relates to vulnerabilities in signal handling for threads, not remote code execution.