CVE-2024-26718

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-26718", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.161Z", "datePublished": "2024-04-03T14:55:18.756Z", "dateUpdated": "2026-08-05T11:26:50.719Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:26:50.719Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-crypt, dm-verity: disable tasklets\n\nTasklets have an inherent problem with memory corruption. The function\ntasklet_action_common calls tasklet_trylock, then it calls the tasklet\ncallback and then it calls tasklet_unlock. If the tasklet callback frees\nthe structure that contains the tasklet or if it calls some code that may\nfree it, tasklet_unlock will write into free memory.\n\nThe commits 8e14f610159d and d9a02e016aaf try to fix it for dm-crypt, but\nit is not a sufficient fix and the data corruption can still happen [1].\nThere is no fix for dm-verity and dm-verity will write into free memory\nwith every tasklet-processed bio.\n\nThere will be atomic workqueues implemented in the kernel 6.9 [2]. They\nwill have better interface and they will not suffer from the memory\ncorruption problem.\n\nBut we need something that stops the memory corruption now and that can be\nbackported to the stable kernels. So, I'm proposing this commit that\ndisables tasklets in both dm-crypt and dm-verity. This commit doesn't\nremove the tasklet support, because the tasklet code will be reused when\natomic workqueues will be implemented.\n\n[1] https://lore.kernel.org/all/d390d7ee-f142-44d3-822a-87949e14608b@suse.de/T/\n[2] https://lore.kernel.org/lkml/20240130091300.2968534-1-tj@kernel.org/"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The write-after-free is reached only through local block I/O against an existing dm-verity or dm-crypt device \u2014 a read()/write() or O_DIRECT access to a file or the device node \u2014 with no network or adjacent-network path to the vulnerable component.\nAC:L - For dm-verity the corruption is fully deterministic: `verity_tasklet()` frees the object via `bio_endio()`\u2192`clone_endio()`\u2192`free_io()` and `tasklet_unlock()` then writes into it on *every* tasklet-processed bio, with no race to win and no memory-layout precondition; the attacker simply issues reads, and the enabling table options (`try_verify_in_tasklet`, `no_read_workqueue`, and the automatic `no_write_workqueue` on zoned/SMR devices) are widely deployed on Android, ChromeOS and cryptsetup-tuned systems.\nPR:L - An ordinary unprivileged local user or Android app triggers the bug just by reading a file that lives on the dm-verity/dm-crypt device; the CAP_SYS_ADMIN check in `dm_ctl_ioctl()` gates only device creation, which is a normal administrator/vendor deployment step rather than something the attacker must perform.\nUI:N - The attacker generates the triggering I/O directly with ordinary read/write syscalls (or O_DIRECT / fadvise DONTNEED to force real bios); no victim action, mount, or file-open by another user is needed.\nS:U - The freed object, the stray `clear_bit()`/`wake_up_var()` write, and all resulting corruption stay within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free on a slab object that is immediately recyclable from the bio mempool, so an attacker who grooms a chosen victim structure into the freed slot can flip a bit in a length, index, flags or pointer field and convert it into a kernel memory disclosure primitive.\nI:H - `tasklet_unlock()` performs an attacker-repeatable `clear_bit(TASKLET_STATE_RUN, &t->state)` at a fixed, known offset inside memory that has already been returned to the bio slab, giving a targeted heap write into a sprayed victim object \u2014 the commit itself describes the result as \"memory corruption\"/\"data corruption,\" which is exploitable toward control-flow hijack and privilege escalation.\nA:H - Writing into a freed and reallocated bio/dm_io allocation corrupts live block-layer state, producing kernel oopses, panics and silent data corruption on every tasklet-processed bio, and the attacker can drive it continuously by sustaining I/O."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/md/dm-crypt.c", "drivers/md/dm-verity-target.c", "drivers/md/dm-verity.h"], "versions": [{"version": "39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877", "lessThan": "b825e0f9d68c178072bffd32dd34c39e3d2d597a", "status": "affected", "versionType": "git"}, {"version": "39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877", "lessThan": "30884a44e0cedc3dfda8c22432f3ba4078ec2d94", "status": "affected", "versionType": "git"}, {"version": "39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877", "lessThan": "5735a2671ffb70ea29ca83969fe01316ee2ed6fc", "status": "affected", "versionType": "git"}, {"version": "39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877", "lessThan": "0c45a20cbe68bc4d681734f5c03891124a274257", "status": "affected", "versionType": "git"}, {"version": "39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877", "lessThan": "0a9bab391e336489169b95cb0d4553d921302189", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/md/dm-crypt.c", "drivers/md/dm-verity-target.c", "drivers/md/dm-verity.h"], "versions": [{"version": "5.9", "status": "affected"}, {"version": "0", "lessThan": "5.9", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.169", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.79", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.18", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.6", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "5.15.169"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.1.79"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.6.18"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.7.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b825e0f9d68c178072bffd32dd34c39e3d2d597a"}, {"url": "https://git.kernel.org/stable/c/30884a44e0cedc3dfda8c22432f3ba4078ec2d94"}, {"url": "https://git.kernel.org/stable/c/5735a2671ffb70ea29ca83969fe01316ee2ed6fc"}, {"url": "https://git.kernel.org/stable/c/0c45a20cbe68bc4d681734f5c03891124a274257"}, {"url": "https://git.kernel.org/stable/c/0a9bab391e336489169b95cb0d4553d921302189"}], "title": "dm-crypt, dm-verity: disable tasklets", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:12.969Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/30884a44e0cedc3dfda8c22432f3ba4078ec2d94", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/5735a2671ffb70ea29ca83969fe01316ee2ed6fc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0c45a20cbe68bc4d681734f5c03891124a274257", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0a9bab391e336489169b95cb0d4553d921302189", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26718", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:52:23.335095Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:24.008Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/30884a44e0cedc3dfda8c22432f3ba4078ec2d94", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/5735a2671ffb70ea29ca83969fe01316ee2ed6fc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0c45a20cbe68bc4d681734f5c03891124a274257", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0a9bab391e336489169b95cb0d4553d921302189", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:12.969Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26718", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:52:23.335095Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:16.504Z"}}], "cna": {"title": "dm-crypt, dm-verity: disable tasklets", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The write-after-free is reached only through local block I/O against an existing dm-verity or dm-crypt device \u2014 a read()/write() or O_DIRECT access to a file or the device node \u2014 with no network or adjacent-network path to the vulnerable component.\nAC:L - For dm-verity the corruption is fully deterministic: `verity_tasklet()` frees the object via `bio_endio()`\u2192`clone_endio()`\u2192`free_io()` and `tasklet_unlock()` then writes into it on *every* tasklet-processed bio, with no race to win and no memory-layout precondition; the attacker simply issues reads, and the enabling table options (`try_verify_in_tasklet`, `no_read_workqueue`, and the automatic `no_write_workqueue` on zoned/SMR devices) are widely deployed on Android, ChromeOS and cryptsetup-tuned systems.\nPR:L - An ordinary unprivileged local user or Android app triggers the bug just by reading a file that lives on the dm-verity/dm-crypt device; the CAP_SYS_ADMIN check in `dm_ctl_ioctl()` gates only device creation, which is a normal administrator/vendor deployment step rather than something the attacker must perform.\nUI:N - The attacker generates the triggering I/O directly with ordinary read/write syscalls (or O_DIRECT / fadvise DONTNEED to force real bios); no victim action, mount, or file-open by another user is needed.\nS:U - The freed object, the stray `clear_bit()`/`wake_up_var()` write, and all resulting corruption stay within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free on a slab object that is immediately recyclable from the bio mempool, so an attacker who grooms a chosen victim structure into the freed slot can flip a bit in a length, index, flags or pointer field and convert it into a kernel memory disclosure primitive.\nI:H - `tasklet_unlock()` performs an attacker-repeatable `clear_bit(TASKLET_STATE_RUN, &t->state)` at a fixed, known offset inside memory that has already been returned to the bio slab, giving a targeted heap write into a sprayed victim object \u2014 the commit itself describes the result as \"memory corruption\"/\"data corruption,\" which is exploitable toward control-flow hijack and privilege escalation.\nA:H - Writing into a freed and reallocated bio/dm_io allocation corrupts live block-layer state, producing kernel oopses, panics and silent data corruption on every tasklet-processed bio, and the attacker can drive it continuously by sustaining I/O."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877", "lessThan": "b825e0f9d68c178072bffd32dd34c39e3d2d597a", "versionType": "git"}, {"status": "affected", "version": "39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877", "lessThan": "30884a44e0cedc3dfda8c22432f3ba4078ec2d94", "versionType": "git"}, {"status": "affected", "version": "39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877", "lessThan": "5735a2671ffb70ea29ca83969fe01316ee2ed6fc", "versionType": "git"}, {"status": "affected", "version": "39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877", "lessThan": "0c45a20cbe68bc4d681734f5c03891124a274257", "versionType": "git"}, {"status": "affected", "version": "39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877", "lessThan": "0a9bab391e336489169b95cb0d4553d921302189", "versionType": "git"}], "programFiles": ["drivers/md/dm-crypt.c", "drivers/md/dm-verity-target.c", "drivers/md/dm-verity.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.9"}, {"status": "unaffected", "version": "0", "lessThan": "5.9", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.169", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.79", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.18", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.6", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/md/dm-crypt.c", "drivers/md/dm-verity-target.c", "drivers/md/dm-verity.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/b825e0f9d68c178072bffd32dd34c39e3d2d597a"}, {"url": "https://git.kernel.org/stable/c/30884a44e0cedc3dfda8c22432f3ba4078ec2d94"}, {"url": "https://git.kernel.org/stable/c/5735a2671ffb70ea29ca83969fe01316ee2ed6fc"}, {"url": "https://git.kernel.org/stable/c/0c45a20cbe68bc4d681734f5c03891124a274257"}, {"url": "https://git.kernel.org/stable/c/0a9bab391e336489169b95cb0d4553d921302189"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-crypt, dm-verity: disable tasklets\n\nTasklets have an inherent problem with memory corruption. The function\ntasklet_action_common calls tasklet_trylock, then it calls the tasklet\ncallback and then it calls tasklet_unlock. If the tasklet callback frees\nthe structure that contains the tasklet or if it calls some code that may\nfree it, tasklet_unlock will write into free memory.\n\nThe commits 8e14f610159d and d9a02e016aaf try to fix it for dm-crypt, but\nit is not a sufficient fix and the data corruption can still happen [1].\nThere is no fix for dm-verity and dm-verity will write into free memory\nwith every tasklet-processed bio.\n\nThere will be atomic workqueues implemented in the kernel 6.9 [2]. They\nwill have better interface and they will not suffer from the memory\ncorruption problem.\n\nBut we need something that stops the memory corruption now and that can be\nbackported to the stable kernels. So, I'm proposing this commit that\ndisables tasklets in both dm-crypt and dm-verity. This commit doesn't\nremove the tasklet support, because the tasklet code will be reused when\natomic workqueues will be implemented.\n\n[1] https://lore.kernel.org/all/d390d7ee-f142-44d3-822a-87949e14608b@suse.de/T/\n[2] https://lore.kernel.org/lkml/20240130091300.2968534-1-tj@kernel.org/"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.169", "versionStartIncluding": "5.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.79", "versionStartIncluding": "5.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.18", "versionStartIncluding": "5.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.6", "versionStartIncluding": "5.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "5.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:26:50.719Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26718", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:26:50.719Z", "dateReserved": "2024-02-19T14:20:24.161Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-03T14:55:18.756Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/md/dm-crypt.c", "drivers/md/dm-verity-target.c", "drivers/md/dm-verity.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b825e0f9d68c178072bffd32dd34c39e3d2d597a", "status": "affected", "version": "39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877", "versionType": "git"}, {"lessThan": "30884a44e0cedc3dfda8c22432f3ba4078ec2d94", "status": "affected", "version": "39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877", "versionType": "git"}, {"lessThan": "5735a2671ffb70ea29ca83969fe01316ee2ed6fc", "status": "affected", "version": "39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877", "versionType": "git"}, {"lessThan": "0c45a20cbe68bc4d681734f5c03891124a274257", "status": "affected", "version": "39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877", "versionType": "git"}, {"lessThan": "0a9bab391e336489169b95cb0d4553d921302189", "status": "affected", "version": "39d42fa96ba1b7d2544db3f8ed5da8fb0d5cb877", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/md/dm-crypt.c", "drivers/md/dm-verity-target.c", "drivers/md/dm-verity.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.9"}, {"lessThan": "5.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.169", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.79", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.18", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9306FADC-BB71-4E0E-81A3-662E21C9A9F1", "versionEndExcluding": "6.1.79", "versionStartIncluding": "5.9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BD961E49-FEDA-47CF-BF23-4D2BD942B4E0", "versionEndExcluding": "6.6.18", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C6D6A5C8-7308-42A9-8A72-ABF3DEA4BB82", "versionEndExcluding": "6.7.6", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*", "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*", "matchCriteriaId": "056BD938-0A27-4569-B391-30578B309EE3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-crypt, dm-verity: disable tasklets\n\nTasklets have an inherent problem with memory corruption. The function\ntasklet_action_common calls tasklet_trylock, then it calls the tasklet\ncallback and then it calls tasklet_unlock. If the tasklet callback frees\nthe structure that contains the tasklet or if it calls some code that may\nfree it, tasklet_unlock will write into free memory.\n\nThe commits 8e14f610159d and d9a02e016aaf try to fix it for dm-crypt, but\nit is not a sufficient fix and the data corruption can still happen [1].\nThere is no fix for dm-verity and dm-verity will write into free memory\nwith every tasklet-processed bio.\n\nThere will be atomic workqueues implemented in the kernel 6.9 [2]. They\nwill have better interface and they will not suffer from the memory\ncorruption problem.\n\nBut we need something that stops the memory corruption now and that can be\nbackported to the stable kernels. So, I'm proposing this commit that\ndisables tasklets in both dm-crypt and dm-verity. This commit doesn't\nremove the tasklet support, because the tasklet code will be reused when\natomic workqueues will be implemented.\n\n[1] https://lore.kernel.org/all/d390d7ee-f142-44d3-822a-87949e14608b@suse.de/T/\n[2] https://lore.kernel.org/lkml/20240130091300.2968534-1-tj@kernel.org/"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dm-crypt, dm-verity: deshabilitar tasklets Los tasklets tienen un problema inherente con la corrupci\u00f3n de la memoria. La funci\u00f3n tasklet_action_common llama a tasklet_trylock, luego llama a la devoluci\u00f3n de llamada del tasklet y luego llama a tasklet_unlock. Si la devoluci\u00f3n de llamada del tasklet libera la estructura que contiene el tasklet o si llama a alg\u00fan c\u00f3digo que pueda liberarlo, tasklet_unlock escribir\u00e1 en la memoria libre. Las confirmaciones 8e14f610159d y d9a02e016aaf intentan solucionarlo para dm-crypt, pero no es una soluci\u00f3n suficiente y la corrupci\u00f3n de datos a\u00fan puede ocurrir [1]. No hay ninguna soluci\u00f3n para dm-verity y dm-verity escribir\u00e1 en la memoria libre con cada biograf\u00eda procesada por tasklet. Habr\u00e1 colas de trabajo at\u00f3micas implementadas en el kernel 6.9 [2]. Tendr\u00e1n una mejor interfaz y no sufrir\u00e1n el problema de corrupci\u00f3n de memoria. Pero necesitamos algo que detenga la corrupci\u00f3n de la memoria ahora y que pueda ser compatible con los n\u00facleos estables. Entonces, propongo esta confirmaci\u00f3n que deshabilita los tasklets tanto en dm-crypt como en dm-verity. Esta confirmaci\u00f3n no elimina la compatibilidad con el tasklet, porque el c\u00f3digo del tasklet se reutilizar\u00e1 cuando se implementen las colas de trabajo at\u00f3micas. [1] https://lore.kernel.org/all/d390d7ee-f142-44d3-822a-87949e14608b@suse.de/T/ [2] https://lore.kernel.org/lkml/20240130091300.2968534-1- tj@kernel.org/"}], "id": "CVE-2024-26718", "lastModified": "2026-08-04T11:16:58.617", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-26718", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:52:23.335095Z", "version": "2.0.3"}}]}, "published": "2024-04-03T15:15:53.897", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0a9bab391e336489169b95cb0d4553d921302189"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0c45a20cbe68bc4d681734f5c03891124a274257"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/30884a44e0cedc3dfda8c22432f3ba4078ec2d94"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5735a2671ffb70ea29ca83969fe01316ee2ed6fc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b825e0f9d68c178072bffd32dd34c39e3d2d597a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0a9bab391e336489169b95cb0d4553d921302189"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0c45a20cbe68bc4d681734f5c03891124a274257"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/30884a44e0cedc3dfda8c22432f3ba4078ec2d94"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5735a2671ffb70ea29ca83969fe01316ee2ed6fc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: dm-crypt, dm-verity: disable tasklets", "id": "2273146", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2273146"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-123", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndm-crypt, dm-verity: disable tasklets\nTasklets have an inherent problem with memory corruption. The function\ntasklet_action_common calls tasklet_trylock, then it calls the tasklet\ncallback and then it calls tasklet_unlock. If the tasklet callback frees\nthe structure that contains the tasklet or if it calls some code that may\nfree it, tasklet_unlock will write into free memory.\nThe commits 8e14f610159d and d9a02e016aaf try to fix it for dm-crypt, but\nit is not a sufficient fix and the data corruption can still happen [1].\nThere is no fix for dm-verity and dm-verity will write into free memory\nwith every tasklet-processed bio.\nThere will be atomic workqueues implemented in the kernel 6.9 [2]. They\nwill have better interface and they will not suffer from the memory\ncorruption problem.\nBut we need something that stops the memory corruption now and that can be\nbackported to the stable kernels. So, I'm proposing this commit that\ndisables tasklets in both dm-crypt and dm-verity. This commit doesn't\nremove the tasklet support, because the tasklet code will be reused when\natomic workqueues will be implemented.\n[1] https://lore.kernel.org/all/d390d7ee-f142-44d3-822a-87949e14608b@suse.de/T/\n[2] https://lore.kernel.org/lkml/20240130091300.2968534-1-tj@kernel.org/"], "name": "CVE-2024-26718", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26718\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26718\nhttps://lore.kernel.org/linux-cve-announce/2024040344-CVE-2024-26718-7259@gregkh/T"], "threat_severity": "Low"}

{}