CVE-2024-26618: arm64/sme: Always exit sme_alloc() early with existing storage
In the Linux kernel, the following vulnerability has been resolved:
arm64/sme: Always exit smealloc() early with existing storage
The Linux kernel CVE team has assigned CVE-2024-26618 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/20240229155245.1571576-50-lee@kernel.org/T
Other sources
In the Linux kernel, the following vulnerability has been resolved:
arm64/sme: Always exit smealloc() early with existing storage
When smealloc() is called with existing storage and we are not flushing we will always allocate new storage, both leaking the existing storage and corrupting the state. Fix this by separating the checks for flushing and for existing storage as we do for SVE.
Callers that reallocate (eg, due to changing the vector length) should call smefree() themselves.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.15 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.3 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.140-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.6.15-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26618?
CVE-2024-26618 has been categorized by the Linux kernel CVE team, but severity ratings may vary based on specific use cases.
How do I fix CVE-2024-26618?
To mitigate CVE-2024-26618, update your kernel to versions 6.6.15, 6.7.3, or 6.8 for Red Hat systems, or ensure you are running appropriate Debian kernel versions.
Which systems are affected by CVE-2024-26618?
CVE-2024-26618 affects certain versions of the Linux kernel across both Red Hat and Debian distributions.
What is the cause of CVE-2024-26618?
CVE-2024-26618 is caused by an issue in the Linux kernel related to the handling of memory allocation in the ARM64 SMEm (Scalable Matrix Engine) architecture.
Has CVE-2024-26618 been resolved?
Yes, CVE-2024-26618 has been resolved in the latest kernel updates from the affected distributions.