CVE-2024-26993: fs: sysfs: Fix reference leak in sysfs_break_active_protection()
fs: sysfs: Fix reference leak in sysfsbreakactiveprotection()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.157 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.88 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.29 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9 - Compensating control
In fs/sysfs, update sysfs_break_active_protection() to explicitly call kobject_put() when kernfs_find_and_get() returns NULL, and do not call sysfs_unbreak_active_protection() when kn is NULL.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26993?
CVE-2024-26993 is categorized as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-26993?
To fix CVE-2024-26993, update the Linux kernel to version 5.15.157, 6.1.88, 6.6.29, 6.8.8, or newer.
Which Linux kernel versions are affected by CVE-2024-26993?
CVE-2024-26993 affects various versions of the Linux kernel, specifically versions prior to 5.15.157, 6.1.88, 6.6.29, and 6.8.8.
What components are impacted by CVE-2024-26993?
CVE-2024-26993 impacts the sysfs component of the Linux kernel.
Is CVE-2024-26993 common in previous kernels?
Yes, CVE-2024-26993 may be common in kernel versions from 3.16.62 to onwards but below the specified patched versions.