CVE-2024-26900: md: fix kmemleak of rdev->serial
In the Linux kernel, the following vulnerability has been resolved:
md: fix kmemleak of rdev->serial
If kobjectadd() is fail in bindrdevtoarray(), 'rdev->serial' will be alloc not be freed, and kmemleak occurs.
unreferenced object 0xffff88815a350000 (size 49152): comm "mdadm", pid 789, jiffies 4294716910 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc f773277a): [<0000000058b0a453>] kmemleakalloc+0x61/0xe0 [<00000000366adf14>] kmalloclargenode+0x15e/0x270 [<000000002e82961b>] kmallocnode.cold+0x11/0x7f [<00000000f206d60a>] kvmallocnode+0x74/0x150 [<0000000034bf3363>] rdevinitserial+0x67/0x170 [<0000000010e08fe9>] mddevcreateserialpool+0x62/0x220 [<00000000c3837bf0>] bindrdevtoarray+0x2af/0x630 [<0000000073c28560>] mdaddnewdisk+0x400/0x9f0 [<00000000770e30ff>] mdioctl+0x15bf/0x1c10 [<000000006cfab718>] blkdevioctl+0x191/0x3f0 [<0000000085086a11>] vfsioctl+0x22/0x60 [<0000000018b656fe>] x64sysioctl+0xba/0xe0 [<00000000e54e675e>] dosyscall64+0x71/0x150 [<000000008b0ad622>] entrySYSCALL64afterhwframe+0x6c/0x74
Other sources
In the Linux kernel, the following vulnerability has been resolved:
md: fix kmemleak of rdev->serial
The Linux kernel CVE team has assigned CVE-2024-26900 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024041745-CVE-2024-26900-70a3@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.11 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.159.1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.35.1-4 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.94-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.7.12-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2024-26900
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26900?
The severity of CVE-2024-26900 is categorized as low.
How do I fix CVE-2024-26900?
To fix CVE-2024-26900, upgrade to kernel versions 6.7.11, 6.8.2, or 6.9 as specified in the advisory.
Which systems are affected by CVE-2024-26900?
CVE-2024-26900 affects systems running Linux kernel versions prior to 6.7.11, 6.8.2, and 6.9.
What kind of vulnerability is CVE-2024-26900?
CVE-2024-26900 is a memory leak vulnerability in the Linux kernel.
Is there a workaround for CVE-2024-26900?
There is no specific workaround for CVE-2024-26900; patching the kernel is recommended.