CVE-2024-26706

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-26706", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.158Z", "datePublished": "2024-04-03T14:55:09.529Z", "dateUpdated": "2026-08-05T11:26:48.578Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:26:48.578Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: Fix random data corruption from exception handler\n\nThe current exception handler implementation, which assists when accessing\nuser space memory, may exhibit random data corruption if the compiler decides\nto use a different register than the specified register %r29 (defined in\nASM_EXCEPTIONTABLE_REG) for the error code. If the compiler choose another\nregister, the fault handler will nevertheless store -EFAULT into %r29 and thus\ntrash whatever this register is used for.\nLooking at the assembly I found that this happens sometimes in emulate_ldd().\n\nTo solve the issue, the easiest solution would be if it somehow is\npossible to tell the fault handler which register is used to hold the error\ncode. Using %0 or %1 in the inline assembly is not posssible as it will show\nup as e.g. %r29 (with the \"%r\" prefix), which the GNU assembler can not\nconvert to an integer.\n\nThis patch takes another, better and more flexible approach:\nWe extend the __ex_table (which is out of the execution path) by one 32-word.\nIn this word we tell the compiler to insert the assembler instruction\n\"or %r0,%r0,%reg\", where %reg references the register which the compiler\nchoosed for the error return code.\nIn case of an access failure, the fault handler finds the __ex_table entry and\ncan examine the opcode. The used register is encoded in the lowest 5 bits, and\nthe fault handler can then store -EFAULT into this register.\n\nSince we extend the __ex_table to 3 words we can't use the BUILDTIME_TABLE_SORT\nconfig option any longer."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Triggering requires executing an unaligned load/store instruction or issuing a syscall with an invalid user pointer on the affected PA-RISC machine, so the attacker must be able to run code locally. There is no network-reachable path into `handle_unaligned()`/`fixup_exception()`.\nAC:L - The attacker deterministically controls the trigger \u2014 mmap a region, unmap the adjacent page, and execute an unaligned access straddling the boundary (or pass a PROT_NONE pointer to any get_user()/put_user() syscall) \u2014 and can repeat it at will with no race to win. The only build-dependent factor is which register GCC allocated, a static property of the deployed binary that the attacker can inspect (parisc has no KASLR) and that was confirmed to occur in practice in `emulate_ldd()`.\nPR:L - Any unprivileged local user can execute an unaligned instruction or call a syscall with a bad pointer; no capabilities, namespaces, or special file access are needed. Unaligned emulation is enabled by default (`unaligned_enabled = 1`).\nUI:N - The attacking process triggers the fault entirely on its own by executing the unaligned instruction or making the syscall. No victim action or cooperation is required.\nS:U - The corruption is confined to kernel registers and kernel memory within the same security authority; there is no hypervisor, IOMMU, or sandbox boundary crossed.\nC:H - The fault handler clobbers whatever live kernel value the compiler placed in %r29 \u2014 a length, index, or pointer at an attacker-chosen call site \u2014 which can be steered into out-of-bounds kernel reads whose results are returned to userspace, and failed get_user()/copy paths are reported as successful so the kernel acts on data it never validly read. Per the guidance, memory corruption leverageable for information disclosure scores High.\nI:H - This is arbitrary kernel data corruption: in `emulate_ldd()` a clobbered `toreg` turns `regs->gr[toreg] = val` into an out-of-bounds write past `pt_regs` on the kernel stack with attacker-influenced data, and failed `put_user()`/`cacheflush()` operations are silently reported as having succeeded. Kernel-stack out-of-bounds writes are a control-flow-hijack primitive.\nA:H - Overwriting a live kernel register with -EFAULT (0xfffffff2) turns pointers and counters into invalid values, producing immediate oops/panic when dereferenced, and the condition is trivially and repeatedly reproducible by an unprivileged user."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/parisc/Kconfig", "arch/parisc/include/asm/assembly.h", "arch/parisc/include/asm/extable.h", "arch/parisc/include/asm/special_insns.h", "arch/parisc/include/asm/uaccess.h", "arch/parisc/kernel/cache.c", "arch/parisc/kernel/unaligned.c", "arch/parisc/mm/fault.c"], "versions": [{"version": "d19f5e41b344a057bb2450024a807476f30978d2", "lessThan": "23027309b099ffc4efca5477009a11dccbdae592", "status": "affected", "versionType": "git"}, {"version": "d19f5e41b344a057bb2450024a807476f30978d2", "lessThan": "fa69a8063f8b27f3c7434a0d4f464a76a62f24d2", "status": "affected", "versionType": "git"}, {"version": "d19f5e41b344a057bb2450024a807476f30978d2", "lessThan": "ce31d79aa1f13a2345791f84935281a2c194e003", "status": "affected", "versionType": "git"}, {"version": "d19f5e41b344a057bb2450024a807476f30978d2", "lessThan": "8b1d72395635af45410b66cc4c4ab37a12c4a831", "status": "affected", "versionType": "git"}, {"version": "09b931fcb87c8aad178475a7db1d4bfc939f7faa", "status": "affected", "versionType": "git"}, {"version": "37e6234297379e0db25e39c2ca99776fea70026c", "status": "affected", "versionType": "git"}, {"version": "4.9.21", "lessThan": "4.10", "status": "affected", "versionType": "semver"}, {"version": "4.10.9", "lessThan": "4.11", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/parisc/Kconfig", "arch/parisc/include/asm/assembly.h", "arch/parisc/include/asm/extable.h", "arch/parisc/include/asm/special_insns.h", "arch/parisc/include/asm/uaccess.h", "arch/parisc/kernel/cache.c", "arch/parisc/kernel/unaligned.c", "arch/parisc/mm/fault.c"], "versions": [{"version": "4.11", "status": "affected"}, {"version": "0", "lessThan": "4.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.79", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.18", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.6", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.1.79"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.6.18"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.7.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/23027309b099ffc4efca5477009a11dccbdae592"}, {"url": "https://git.kernel.org/stable/c/fa69a8063f8b27f3c7434a0d4f464a76a62f24d2"}, {"url": "https://git.kernel.org/stable/c/ce31d79aa1f13a2345791f84935281a2c194e003"}, {"url": "https://git.kernel.org/stable/c/8b1d72395635af45410b66cc4c4ab37a12c4a831"}], "title": "parisc: Fix random data corruption from exception handler", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-17T19:29:32.394995Z", "id": "CVE-2024-26706", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T19:29:43.758Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:12.642Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/23027309b099ffc4efca5477009a11dccbdae592", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/fa69a8063f8b27f3c7434a0d4f464a76a62f24d2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ce31d79aa1f13a2345791f84935281a2c194e003", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8b1d72395635af45410b66cc4c4ab37a12c4a831", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/23027309b099ffc4efca5477009a11dccbdae592", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/fa69a8063f8b27f3c7434a0d4f464a76a62f24d2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ce31d79aa1f13a2345791f84935281a2c194e003", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8b1d72395635af45410b66cc4c4ab37a12c4a831", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:12.642Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26706", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-17T19:29:32.394995Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T19:29:37.609Z"}}], "cna": {"title": "parisc: Fix random data corruption from exception handler", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Triggering requires executing an unaligned load/store instruction or issuing a syscall with an invalid user pointer on the affected PA-RISC machine, so the attacker must be able to run code locally. There is no network-reachable path into `handle_unaligned()`/`fixup_exception()`.\nAC:L - The attacker deterministically controls the trigger \u2014 mmap a region, unmap the adjacent page, and execute an unaligned access straddling the boundary (or pass a PROT_NONE pointer to any get_user()/put_user() syscall) \u2014 and can repeat it at will with no race to win. The only build-dependent factor is which register GCC allocated, a static property of the deployed binary that the attacker can inspect (parisc has no KASLR) and that was confirmed to occur in practice in `emulate_ldd()`.\nPR:L - Any unprivileged local user can execute an unaligned instruction or call a syscall with a bad pointer; no capabilities, namespaces, or special file access are needed. Unaligned emulation is enabled by default (`unaligned_enabled = 1`).\nUI:N - The attacking process triggers the fault entirely on its own by executing the unaligned instruction or making the syscall. No victim action or cooperation is required.\nS:U - The corruption is confined to kernel registers and kernel memory within the same security authority; there is no hypervisor, IOMMU, or sandbox boundary crossed.\nC:H - The fault handler clobbers whatever live kernel value the compiler placed in %r29 \u2014 a length, index, or pointer at an attacker-chosen call site \u2014 which can be steered into out-of-bounds kernel reads whose results are returned to userspace, and failed get_user()/copy paths are reported as successful so the kernel acts on data it never validly read. Per the guidance, memory corruption leverageable for information disclosure scores High.\nI:H - This is arbitrary kernel data corruption: in `emulate_ldd()` a clobbered `toreg` turns `regs->gr[toreg] = val` into an out-of-bounds write past `pt_regs` on the kernel stack with attacker-influenced data, and failed `put_user()`/`cacheflush()` operations are silently reported as having succeeded. Kernel-stack out-of-bounds writes are a control-flow-hijack primitive.\nA:H - Overwriting a live kernel register with -EFAULT (0xfffffff2) turns pointers and counters into invalid values, producing immediate oops/panic when dereferenced, and the condition is trivially and repeatedly reproducible by an unprivileged user."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d19f5e41b344a057bb2450024a807476f30978d2", "lessThan": "23027309b099ffc4efca5477009a11dccbdae592", "versionType": "git"}, {"status": "affected", "version": "d19f5e41b344a057bb2450024a807476f30978d2", "lessThan": "fa69a8063f8b27f3c7434a0d4f464a76a62f24d2", "versionType": "git"}, {"status": "affected", "version": "d19f5e41b344a057bb2450024a807476f30978d2", "lessThan": "ce31d79aa1f13a2345791f84935281a2c194e003", "versionType": "git"}, {"status": "affected", "version": "d19f5e41b344a057bb2450024a807476f30978d2", "lessThan": "8b1d72395635af45410b66cc4c4ab37a12c4a831", "versionType": "git"}, {"status": "affected", "version": "09b931fcb87c8aad178475a7db1d4bfc939f7faa", "versionType": "git"}, {"status": "affected", "version": "37e6234297379e0db25e39c2ca99776fea70026c", "versionType": "git"}, {"status": "affected", "version": "4.9.21", "lessThan": "4.10", "versionType": "semver"}, {"status": "affected", "version": "4.10.9", "lessThan": "4.11", "versionType": "semver"}], "programFiles": ["arch/parisc/Kconfig", "arch/parisc/include/asm/assembly.h", "arch/parisc/include/asm/extable.h", "arch/parisc/include/asm/special_insns.h", "arch/parisc/include/asm/uaccess.h", "arch/parisc/kernel/cache.c", "arch/parisc/kernel/unaligned.c", "arch/parisc/mm/fault.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.11"}, {"status": "unaffected", "version": "0", "lessThan": "4.11", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.79", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.18", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.6", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/parisc/Kconfig", "arch/parisc/include/asm/assembly.h", "arch/parisc/include/asm/extable.h", "arch/parisc/include/asm/special_insns.h", "arch/parisc/include/asm/uaccess.h", "arch/parisc/kernel/cache.c", "arch/parisc/kernel/unaligned.c", "arch/parisc/mm/fault.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/23027309b099ffc4efca5477009a11dccbdae592"}, {"url": "https://git.kernel.org/stable/c/fa69a8063f8b27f3c7434a0d4f464a76a62f24d2"}, {"url": "https://git.kernel.org/stable/c/ce31d79aa1f13a2345791f84935281a2c194e003"}, {"url": "https://git.kernel.org/stable/c/8b1d72395635af45410b66cc4c4ab37a12c4a831"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: Fix random data corruption from exception handler\n\nThe current exception handler implementation, which assists when accessing\nuser space memory, may exhibit random data corruption if the compiler decides\nto use a different register than the specified register %r29 (defined in\nASM_EXCEPTIONTABLE_REG) for the error code. If the compiler choose another\nregister, the fault handler will nevertheless store -EFAULT into %r29 and thus\ntrash whatever this register is used for.\nLooking at the assembly I found that this happens sometimes in emulate_ldd().\n\nTo solve the issue, the easiest solution would be if it somehow is\npossible to tell the fault handler which register is used to hold the error\ncode. Using %0 or %1 in the inline assembly is not posssible as it will show\nup as e.g. %r29 (with the \"%r\" prefix), which the GNU assembler can not\nconvert to an integer.\n\nThis patch takes another, better and more flexible approach:\nWe extend the __ex_table (which is out of the execution path) by one 32-word.\nIn this word we tell the compiler to insert the assembler instruction\n\"or %r0,%r0,%reg\", where %reg references the register which the compiler\nchoosed for the error return code.\nIn case of an access failure, the fault handler finds the __ex_table entry and\ncan examine the opcode. The used register is encoded in the lowest 5 bits, and\nthe fault handler can then store -EFAULT into this register.\n\nSince we extend the __ex_table to 3 words we can't use the BUILDTIME_TABLE_SORT\nconfig option any longer."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.79", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.18", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.6", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.9.21"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.10.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:26:48.578Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26706", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:26:48.578Z", "dateReserved": "2024-02-19T14:20:24.158Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-03T14:55:09.529Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/parisc/Kconfig", "arch/parisc/include/asm/assembly.h", "arch/parisc/include/asm/extable.h", "arch/parisc/include/asm/special_insns.h", "arch/parisc/include/asm/uaccess.h", "arch/parisc/kernel/cache.c", "arch/parisc/kernel/unaligned.c", "arch/parisc/mm/fault.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "23027309b099ffc4efca5477009a11dccbdae592", "status": "affected", "version": "d19f5e41b344a057bb2450024a807476f30978d2", "versionType": "git"}, {"lessThan": "fa69a8063f8b27f3c7434a0d4f464a76a62f24d2", "status": "affected", "version": "d19f5e41b344a057bb2450024a807476f30978d2", "versionType": "git"}, {"lessThan": "ce31d79aa1f13a2345791f84935281a2c194e003", "status": "affected", "version": "d19f5e41b344a057bb2450024a807476f30978d2", "versionType": "git"}, {"lessThan": "8b1d72395635af45410b66cc4c4ab37a12c4a831", "status": "affected", "version": "d19f5e41b344a057bb2450024a807476f30978d2", "versionType": "git"}, {"status": "affected", "version": "09b931fcb87c8aad178475a7db1d4bfc939f7faa", "versionType": "git"}, {"status": "affected", "version": "37e6234297379e0db25e39c2ca99776fea70026c", "versionType": "git"}, {"lessThan": "4.10", "status": "affected", "version": "4.9.21", "versionType": "semver"}, {"lessThan": "4.11", "status": "affected", "version": "4.10.9", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/parisc/Kconfig", "arch/parisc/include/asm/assembly.h", "arch/parisc/include/asm/extable.h", "arch/parisc/include/asm/special_insns.h", "arch/parisc/include/asm/uaccess.h", "arch/parisc/kernel/cache.c", "arch/parisc/kernel/unaligned.c", "arch/parisc/mm/fault.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.11"}, {"lessThan": "4.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.79", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.18", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0CD66F01-9687-41BC-ADEE-C4E51121167A", "versionEndExcluding": "6.1.79", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BD961E49-FEDA-47CF-BF23-4D2BD942B4E0", "versionEndExcluding": "6.6.18", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C6D6A5C8-7308-42A9-8A72-ABF3DEA4BB82", "versionEndExcluding": "6.7.6", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*", "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*", "matchCriteriaId": "056BD938-0A27-4569-B391-30578B309EE3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: Fix random data corruption from exception handler\n\nThe current exception handler implementation, which assists when accessing\nuser space memory, may exhibit random data corruption if the compiler decides\nto use a different register than the specified register %r29 (defined in\nASM_EXCEPTIONTABLE_REG) for the error code. If the compiler choose another\nregister, the fault handler will nevertheless store -EFAULT into %r29 and thus\ntrash whatever this register is used for.\nLooking at the assembly I found that this happens sometimes in emulate_ldd().\n\nTo solve the issue, the easiest solution would be if it somehow is\npossible to tell the fault handler which register is used to hold the error\ncode. Using %0 or %1 in the inline assembly is not posssible as it will show\nup as e.g. %r29 (with the \"%r\" prefix), which the GNU assembler can not\nconvert to an integer.\n\nThis patch takes another, better and more flexible approach:\nWe extend the __ex_table (which is out of the execution path) by one 32-word.\nIn this word we tell the compiler to insert the assembler instruction\n\"or %r0,%r0,%reg\", where %reg references the register which the compiler\nchoosed for the error return code.\nIn case of an access failure, the fault handler finds the __ex_table entry and\ncan examine the opcode. The used register is encoded in the lowest 5 bits, and\nthe fault handler can then store -EFAULT into this register.\n\nSince we extend the __ex_table to 3 words we can't use the BUILDTIME_TABLE_SORT\nconfig option any longer."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: parisc: corrige la corrupci\u00f3n aleatoria de datos del controlador de excepciones La implementaci\u00f3n actual del controlador de excepciones, que ayuda al acceder a la memoria del espacio del usuario, puede exhibir corrupci\u00f3n aleatoria de datos si el compilador decide usar un registro diferente al el registro especificado %r29 (definido en ASM_EXCEPTIONTABLE_REG) para el c\u00f3digo de error. Si el compilador elige otro registro, el manejador de fallas almacenar\u00e1 -EFAULT en %r29 y, por lo tanto, eliminar\u00e1 cualquier cosa para la que se utilice este registro. Al observar el ensamblaje, encontr\u00e9 que esto sucede a veces en emulate_ldd(). Para resolver el problema, la soluci\u00f3n m\u00e1s sencilla ser\u00eda si de alguna manera fuera posible decirle al manejador de fallas qu\u00e9 registro se utiliza para contener el c\u00f3digo de error. No es posible usar %0 o %1 en el ensamblador en l\u00ednea ya que aparecer\u00e1, por ejemplo, como %r29 (con el prefijo \"%r\"), que el ensamblador GNU no puede convertir a un n\u00famero entero. Este parche adopta otro enfoque mejor y m\u00e1s flexible: ampliamos el __ex_table (que est\u00e1 fuera de la ruta de ejecuci\u00f3n) en 32 palabras. En esta palabra le decimos al compilador que inserte la instrucci\u00f3n ensambladora \"o %r0,%r0,%reg\", donde %reg hace referencia al registro que el compilador eligi\u00f3 para el c\u00f3digo de retorno de error. En caso de un error de acceso, el controlador de fallas encuentra la entrada __ex_table y puede examinar el c\u00f3digo de operaci\u00f3n. El registro utilizado est\u00e1 codificado en los 5 bits m\u00e1s bajos y el manejador de fallas puede almacenar -EFAULT en este registro. Dado que ampliamos __ex_table a 3 palabras, ya no podemos usar la opci\u00f3n de configuraci\u00f3n BUILDTIME_TABLE_SORT."}], "id": "CVE-2024-26706", "lastModified": "2026-08-04T11:16:57.990", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-26706", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-06-17T19:29:32.394995Z", "version": "2.0.3"}}]}, "published": "2024-04-03T15:15:53.293", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/23027309b099ffc4efca5477009a11dccbdae592"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8b1d72395635af45410b66cc4c4ab37a12c4a831"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ce31d79aa1f13a2345791f84935281a2c194e003"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fa69a8063f8b27f3c7434a0d4f464a76a62f24d2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/23027309b099ffc4efca5477009a11dccbdae592"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8b1d72395635af45410b66cc4c4ab37a12c4a831"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ce31d79aa1f13a2345791f84935281a2c194e003"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fa69a8063f8b27f3c7434a0d4f464a76a62f24d2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: parisc: Fix random data corruption from exception handler", "id": "2273170", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2273170"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-99", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nparisc: Fix random data corruption from exception handler\nThe current exception handler implementation, which assists when accessing\nuser space memory, may exhibit random data corruption if the compiler decides\nto use a different register than the specified register %r29 (defined in\nASM_EXCEPTIONTABLE_REG) for the error code. If the compiler choose another\nregister, the fault handler will nevertheless store -EFAULT into %r29 and thus\ntrash whatever this register is used for.\nLooking at the assembly I found that this happens sometimes in emulate_ldd().\nTo solve the issue, the easiest solution would be if it somehow is\npossible to tell the fault handler which register is used to hold the error\ncode. Using %0 or %1 in the inline assembly is not posssible as it will show\nup as e.g. %r29 (with the \"%r\" prefix), which the GNU assembler can not\nconvert to an integer.\nThis patch takes another, better and more flexible approach:\nWe extend the __ex_table (which is out of the execution path) by one 32-word.\nIn this word we tell the compiler to insert the assembler instruction\n\"or %r0,%r0,%reg\", where %reg references the register which the compiler\nchoosed for the error return code.\nIn case of an access failure, the fault handler finds the __ex_table entry and\ncan examine the opcode. The used register is encoded in the lowest 5 bits, and\nthe fault handler can then store -EFAULT into this register.\nSince we extend the __ex_table to 3 words we can't use the BUILDTIME_TABLE_SORT\nconfig option any longer."], "name": "CVE-2024-26706", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26706\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26706\nhttps://lore.kernel.org/linux-cve-announce/2024040341-CVE-2024-26706-844b@gregkh/T"], "threat_severity": "Low"}

{}