CVE-2024-26983: bootconfig: use memblock_free_late to free xbc memory to buddy
bootconfig: use memblockfreelate to free xbc memory to buddy
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Configuration
Update the bootconfig xbc memory free logic: call memblock_free() in the early xbc init error rewind path, and call memblock_free_late() in the xbc exit path to free xbc memory to the buddy allocator (instead of freeing it back to memblock / using memblock_free at xbc_exit that can cause UAF).
Linux kernel (bootconfig/xbC) Use memblock_free() in early xbc init error rewind path and memblock_free_late() in xbc_exit() = memblock_free (early rewind path); memblock_free_late (xbc_exit path)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26983?
CVE-2024-26983 has a severity rating that could potentially allow unauthorized memory access.
How do I fix CVE-2024-26983?
To remediate CVE-2024-26983, upgrade your Linux Kernel to the appropriate patched version, such as 5.10.223-1 or 6.12.11-1.
Which versions of the Linux Kernel are affected by CVE-2024-26983?
CVE-2024-26983 affects Linux Kernel versions between 5.15 and 6.1.88, 6.2 and 6.6.29, and 6.7 and 6.8.8, as well as multiple release candidates in the 6.9 series.
Is CVE-2024-26983 a remote code execution vulnerability?
No, CVE-2024-26983 is not primarily classified as a remote code execution vulnerability.
What kind of impact could CVE-2024-26983 have on systems?
CVE-2024-26983 could lead to memory mismanagement that could affect system stability and performance.