CVE-2024-26674: x86/lib: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups

Published Apr 2, 2024
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

x86/lib: Revert to ASMEXTABLEUA() for {get,put}user() fixups

During memory error injection test on kernels >= v6.4, the kernel panics like below. However, this issue couldn't be reproduced on kernels <= v6.3.

mce: [Hardware Error]: CPU 296: Machine Check Exception: f Bank 1: bd80000000100134 mce: [Hardware Error]: RIP 10:<ffffffff821b9776> {getusernocheck4+0x6/0x20} mce: [Hardware Error]: TSC 411a93533ed ADDR 346a8730040 MISC 86 mce: [Hardware Error]: PROCESSOR 0:a06d0 TIME 1706000767 SOCKET 1 APIC 211 microcode 80001490 mce: [Hardware Error]: Run the above through 'mcelog --ascii' mce: [Hardware Error]: Machine check: Data load in unrecoverable area of kernel Kernel panic - not syncing: Fatal local machine check

The MCA code can recover from an in-kernel #MC if the fixup type is EXTYPEUACCESS, explicitly indicating that the kernel is attempting to access userspace memory. However, if the fixup type is EXTYPEDEFAULT the only thing that is raised for an in-kernel #MC is a panic.

exhandleruaccess() would warn if users gave a non-canonical addresses (with bit 63 clear) to {get, put}user(), which was unexpected.

Therefore, commit

b19b74bc99b1 ("x86/mm: Rework address range check in getuser() and putuser()")

replaced ASMEXTABLEUA() with ASMEXTABLE() for {get, put}user() fixups. However, the new fixup type EXTYPEDEFAULT results in a panic.

Commit

6014bc27561f ("x86-64: make accessok() independent of LAM")

added the check gpfaultaddressok() right before the WARNONCE() in exhandleruaccess() to not warn about non-canonical user addresses due to LAM.

With that in place, revert back to ASMEXTABLEUA() for {get,put}user() exception fixups in order to be able to handle in-kernel MCEs correctly again.

[ bp: Massage commit message. ]

Other sources

In the Linux kernel, the following vulnerability has been resolved:

x86/lib: Revert to ASMEXTABLEUA() for {get,put}user() fixups

The Linux kernel CVE team has assigned CVE-2024-26674 to this issue.

Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040252-CVE-2024-26674-4ff9@gregkh/T

Red Hat

Affected Software

9 affected componentsFixes available
redhat/kernel<6.6.17
6.6.17
redhat/kernel<6.7.5
6.7.5
redhat/kernel<6.8
6.8
Linux Linux kernel>=6.4<6.6.17
Linux Linux kernel>=6.7<6.7.5
Linux Linux kernel=6.8-rc1
Linux Linux kernel=6.8-rc2
Linux Linux kernel=6.8-rc3
debian/linux
5.10.223-15.10.234-16.1.129-16.1.133-16.12.22-16.12.25-1

Event History

Apr 2, 2024
CVE Published
via MITRE·07:01 AM
Data Sourced
via MITRE·07:01 AM
Description
Data Sourced
via Red Hat·11:44 PM
DescriptionSeverityAffected Software
Jul 12, 2024
Data Sourced
via Launchpad·12:46 PM
Description
Mar 26, 2025
Data Sourced
via Ubuntu·12:07 AM
RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2024-26674?

CVE-2024-26674 is classified as a moderate severity vulnerability that affects certain versions of the Linux kernel.

2

How do I fix CVE-2024-26674?

To mitigate CVE-2024-26674, you should upgrade your Linux kernel to the fixed versions: 6.6.17, 6.7.5, 6.8, or specific versions like 5.10.223-1.

3

Which Linux kernel versions are affected by CVE-2024-26674?

CVE-2024-26674 affects Linux kernel versions 6.4 and later.

4

What are the potential impacts of CVE-2024-26674?

Exploitation of CVE-2024-26674 may lead to kernel panics during memory error injection tests.

5

What does CVE-2024-26674 involve in its resolution?

CVE-2024-26674 involves reverting to _ASM_EXTABLE_UA() for {get,put}_user() fixups in the Linux kernel.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203