CVE-2024-26926

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-26926", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.194Z", "datePublished": "2024-04-24T23:23:40.600Z", "dateUpdated": "2026-08-05T11:28:24.537Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:28:24.537Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: check offset alignment in binder_get_object()\n\nCommit 6d98eb95b450 (\"binder: avoid potential data leakage when copying\ntxn\") introduced changes to how binder objects are copied. In doing so,\nit unintentionally removed an offset alignment check done through calls\nto binder_alloc_copy_from_buffer() -> check_buffer().\n\nThese calls were replaced in binder_get_object() with copy_from_user(),\nso now an explicit offset alignment check is needed here. This avoids\nlater complications when unwinding the objects gets harder.\n\nIt is worth noting this check existed prior to commit 7a67a39320df\n(\"binder: add function to copy binder object from buffer\"), likely\nremoved due to redundancy at the time."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached through `ioctl(BINDER_WRITE_READ)` with `BC_TRANSACTION` on `/dev/binder` or a binderfs device node, requiring local access to the system. There is no remote or adjacent-network path into `binder_transaction()`.\nAC:L - The attacker fully and deterministically controls the offsets array and the transaction payload, so supplying a misaligned offset triggers the flawed path on the first try with no race, timing, or memory-layout dependency.\nPR:L - Any unprivileged local process can drive this \u2014 on Android every installed app holds binder access by design, and on general-purpose kernels binderfs is `FS_USERNS_MOUNT` while `BINDER_SET_CONTEXT_MGR` carries no capability check, so an ordinary user can set up both sender and target inside `unshare -Urn`.\nUI:N - The attacker issues the malformed transaction entirely from its own process; no victim action, file open, or mount by another user is needed.\nS:U - The mismanaged state is binder driver data owned by the kernel, and impact remains within the kernel's own security authority rather than crossing a hypervisor, IOMMU, or sandbox boundary.\nC:H - Dropping the alignment guard lets an unprivileged process desynchronize binder's object accounting so that `binder_node`/`binder_ref` lifetimes are no longer correctly tracked by the driver's refcounting \u2014 the same protection that prevents stale-object access \u2014 and this class of binder bookkeeping flaw is the established route to kernel memory read primitives on Android.\nI:H - The attacker causes unauthorized, permanent modification of another process's binder reference table and of node reference counts, state the attacker has no right to alter, and the resulting lifetime-tracking inconsistency is memory-safety relevant and leveragable toward write primitives.\nA:H - Every malformed transaction leaks a `binder_node` plus a `binder_ref` that the unwind path can never reclaim, and the loop can be repeated without bound against a chosen victim process, driving unreclaimable kernel allocation to OOM on memory-constrained Android and embedded devices."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/android/binder.c"], "versions": [{"version": "c056a6ba35e00ae943e377eb09abd77a6915b31a", "lessThan": "68a28f551e4690db2b27b3db716c7395f6fada12", "status": "affected", "versionType": "git"}, {"version": "23e9d815fad84c1bee3742a8de4bd39510435362", "lessThan": "48a1f83ca9c68518b1a783c62e6a8223144fa9fc", "status": "affected", "versionType": "git"}, {"version": "7a9ad4aceb0226b391c9d3b8e4ac2e7d438b6bde", "lessThan": "a2fd6dbc98be1105a1d8e9e31575da8873ef115c", "status": "affected", "versionType": "git"}, {"version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c", "lessThan": "a6d2a8b211c874971ee4cf3ddd167408177f6e76", "status": "affected", "versionType": "git"}, {"version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c", "lessThan": "1d7f1049035b2060342f11eff957cf567d810bdc", "status": "affected", "versionType": "git"}, {"version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c", "lessThan": "f01d6619045704d78613b14e2e0420bfdb7f1c15", "status": "affected", "versionType": "git"}, {"version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c", "lessThan": "aaef73821a3b0194a01bd23ca77774f704a04d40", "status": "affected", "versionType": "git"}, {"version": "66e12f5b3a9733f941893a00753b10498724607d", "status": "affected", "versionType": "git"}, {"version": "5.4.226", "lessThan": "5.4.275", "status": "affected", "versionType": "semver"}, {"version": "5.10.157", "lessThan": "5.10.216", "status": "affected", "versionType": "semver"}, {"version": "5.15.17", "lessThan": "5.15.157", "status": "affected", "versionType": "semver"}, {"version": "5.16.3", "lessThan": "5.17", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/android/binder.c"], "versions": [{"version": "5.17", "status": "affected"}, {"version": "0", "lessThan": "5.17", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.275", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.216", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.157", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.88", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.29", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.8", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.226", "versionEndExcluding": "5.4.275"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.157", "versionEndExcluding": "5.10.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.17", "versionEndExcluding": "5.15.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.1.88"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.6.29"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.8.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12"}, {"url": "https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc"}, {"url": "https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c"}, {"url": "https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76"}, {"url": "https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc"}, {"url": "https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15"}, {"url": "https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40"}], "title": "binder: check offset alignment in binder_get_object()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"affected": [{"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "c056a6ba35e0", "status": "affected", "lessThan": "68a28f551e46", "versionType": "custom"}, {"version": "23e9d815fad8", "status": "affected", "lessThan": "48a1f83ca9c6", "versionType": "custom"}, {"version": "7a9ad4aceb02", "status": "affected", "lessThan": "a2fd6dbc98be", "versionType": "custom"}, {"version": "6d98eb95b450", "status": "affected", "lessThan": "a6d2a8b211c8", "versionType": "custom"}, {"version": "6d98eb95b450", "status": "affected", "lessThan": "1d7f1049035b", "versionType": "custom"}, {"version": "6d98eb95b450", "status": "affected", "lessThan": "f01d66190457", "versionType": "custom"}, {"version": "6d98eb95b450", "status": "affected", "lessThan": "aaef73821a3b", "versionType": "custom"}]}, {"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "5.17", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-13T03:55:21.790532Z", "id": "CVE-2024-26926", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-13T14:39:55.884Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.552Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.552Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26926", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-06-13T03:55:21.790532Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "c056a6ba35e0", "lessThan": "68a28f551e46", "versionType": "custom"}, {"status": "affected", "version": "23e9d815fad8", "lessThan": "48a1f83ca9c6", "versionType": "custom"}, {"status": "affected", "version": "7a9ad4aceb02", "lessThan": "a2fd6dbc98be", "versionType": "custom"}, {"status": "affected", "version": "6d98eb95b450", "lessThan": "a6d2a8b211c8", "versionType": "custom"}, {"status": "affected", "version": "6d98eb95b450", "lessThan": "1d7f1049035b", "versionType": "custom"}, {"status": "affected", "version": "6d98eb95b450", "lessThan": "f01d66190457", "versionType": "custom"}, {"status": "affected", "version": "6d98eb95b450", "lessThan": "aaef73821a3b", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "5.17"}], "defaultStatus": "affected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-13T14:39:51.124Z"}}], "cna": {"title": "binder: check offset alignment in binder_get_object()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached through `ioctl(BINDER_WRITE_READ)` with `BC_TRANSACTION` on `/dev/binder` or a binderfs device node, requiring local access to the system. There is no remote or adjacent-network path into `binder_transaction()`.\nAC:L - The attacker fully and deterministically controls the offsets array and the transaction payload, so supplying a misaligned offset triggers the flawed path on the first try with no race, timing, or memory-layout dependency.\nPR:L - Any unprivileged local process can drive this \u2014 on Android every installed app holds binder access by design, and on general-purpose kernels binderfs is `FS_USERNS_MOUNT` while `BINDER_SET_CONTEXT_MGR` carries no capability check, so an ordinary user can set up both sender and target inside `unshare -Urn`.\nUI:N - The attacker issues the malformed transaction entirely from its own process; no victim action, file open, or mount by another user is needed.\nS:U - The mismanaged state is binder driver data owned by the kernel, and impact remains within the kernel's own security authority rather than crossing a hypervisor, IOMMU, or sandbox boundary.\nC:H - Dropping the alignment guard lets an unprivileged process desynchronize binder's object accounting so that `binder_node`/`binder_ref` lifetimes are no longer correctly tracked by the driver's refcounting \u2014 the same protection that prevents stale-object access \u2014 and this class of binder bookkeeping flaw is the established route to kernel memory read primitives on Android.\nI:H - The attacker causes unauthorized, permanent modification of another process's binder reference table and of node reference counts, state the attacker has no right to alter, and the resulting lifetime-tracking inconsistency is memory-safety relevant and leveragable toward write primitives.\nA:H - Every malformed transaction leaks a `binder_node` plus a `binder_ref` that the unwind path can never reclaim, and the loop can be repeated without bound against a chosen victim process, driving unreclaimable kernel allocation to OOM on memory-constrained Android and embedded devices."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "c056a6ba35e00ae943e377eb09abd77a6915b31a", "lessThan": "68a28f551e4690db2b27b3db716c7395f6fada12", "versionType": "git"}, {"status": "affected", "version": "23e9d815fad84c1bee3742a8de4bd39510435362", "lessThan": "48a1f83ca9c68518b1a783c62e6a8223144fa9fc", "versionType": "git"}, {"status": "affected", "version": "7a9ad4aceb0226b391c9d3b8e4ac2e7d438b6bde", "lessThan": "a2fd6dbc98be1105a1d8e9e31575da8873ef115c", "versionType": "git"}, {"status": "affected", "version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c", "lessThan": "a6d2a8b211c874971ee4cf3ddd167408177f6e76", "versionType": "git"}, {"status": "affected", "version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c", "lessThan": "1d7f1049035b2060342f11eff957cf567d810bdc", "versionType": "git"}, {"status": "affected", "version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c", "lessThan": "f01d6619045704d78613b14e2e0420bfdb7f1c15", "versionType": "git"}, {"status": "affected", "version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c", "lessThan": "aaef73821a3b0194a01bd23ca77774f704a04d40", "versionType": "git"}, {"status": "affected", "version": "66e12f5b3a9733f941893a00753b10498724607d", "versionType": "git"}, {"status": "affected", "version": "5.4.226", "lessThan": "5.4.275", "versionType": "semver"}, {"status": "affected", "version": "5.10.157", "lessThan": "5.10.216", "versionType": "semver"}, {"status": "affected", "version": "5.15.17", "lessThan": "5.15.157", "versionType": "semver"}, {"status": "affected", "version": "5.16.3", "lessThan": "5.17", "versionType": "semver"}], "programFiles": ["drivers/android/binder.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.17"}, {"status": "unaffected", "version": "0", "lessThan": "5.17", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.275", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.216", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.157", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.88", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.29", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.8", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/android/binder.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12"}, {"url": "https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc"}, {"url": "https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c"}, {"url": "https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76"}, {"url": "https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc"}, {"url": "https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15"}, {"url": "https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: check offset alignment in binder_get_object()\n\nCommit 6d98eb95b450 (\"binder: avoid potential data leakage when copying\ntxn\") introduced changes to how binder objects are copied. In doing so,\nit unintentionally removed an offset alignment check done through calls\nto binder_alloc_copy_from_buffer() -> check_buffer().\n\nThese calls were replaced in binder_get_object() with copy_from_user(),\nso now an explicit offset alignment check is needed here. This avoids\nlater complications when unwinding the objects gets harder.\n\nIt is worth noting this check existed prior to commit 7a67a39320df\n(\"binder: add function to copy binder object from buffer\"), likely\nremoved due to redundancy at the time."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.275", "versionStartIncluding": "5.4.226"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.216", "versionStartIncluding": "5.10.157"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.157", "versionStartIncluding": "5.15.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.88", "versionStartIncluding": "5.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.29", "versionStartIncluding": "5.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.8", "versionStartIncluding": "5.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "5.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.16.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:28:24.537Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26926", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:28:24.537Z", "dateReserved": "2024-02-19T14:20:24.194Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-24T23:23:40.600Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/android/binder.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "68a28f551e4690db2b27b3db716c7395f6fada12", "status": "affected", "version": "c056a6ba35e00ae943e377eb09abd77a6915b31a", "versionType": "git"}, {"lessThan": "48a1f83ca9c68518b1a783c62e6a8223144fa9fc", "status": "affected", "version": "23e9d815fad84c1bee3742a8de4bd39510435362", "versionType": "git"}, {"lessThan": "a2fd6dbc98be1105a1d8e9e31575da8873ef115c", "status": "affected", "version": "7a9ad4aceb0226b391c9d3b8e4ac2e7d438b6bde", "versionType": "git"}, {"lessThan": "a6d2a8b211c874971ee4cf3ddd167408177f6e76", "status": "affected", "version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c", "versionType": "git"}, {"lessThan": "1d7f1049035b2060342f11eff957cf567d810bdc", "status": "affected", "version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c", "versionType": "git"}, {"lessThan": "f01d6619045704d78613b14e2e0420bfdb7f1c15", "status": "affected", "version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c", "versionType": "git"}, {"lessThan": "aaef73821a3b0194a01bd23ca77774f704a04d40", "status": "affected", "version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c", "versionType": "git"}, {"status": "affected", "version": "66e12f5b3a9733f941893a00753b10498724607d", "versionType": "git"}, {"lessThan": "5.4.275", "status": "affected", "version": "5.4.226", "versionType": "semver"}, {"lessThan": "5.10.216", "status": "affected", "version": "5.10.157", "versionType": "semver"}, {"lessThan": "5.15.157", "status": "affected", "version": "5.15.17", "versionType": "semver"}, {"lessThan": "5.17", "status": "affected", "version": "5.16.3", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/android/binder.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.17"}, {"lessThan": "5.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.275", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.216", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.157", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.88", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.29", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "linux_kernel", "vendor": "linux", "versions": [{"lessThan": "68a28f551e46", "status": "affected", "version": "c056a6ba35e0", "versionType": "custom"}, {"lessThan": "48a1f83ca9c6", "status": "affected", "version": "23e9d815fad8", "versionType": "custom"}, {"lessThan": "a2fd6dbc98be", "status": "affected", "version": "7a9ad4aceb02", "versionType": "custom"}, {"lessThan": "a6d2a8b211c8", "status": "affected", "version": "6d98eb95b450", "versionType": "custom"}, {"lessThan": "1d7f1049035b", "status": "affected", "version": "6d98eb95b450", "versionType": "custom"}, {"lessThan": "f01d66190457", "status": "affected", "version": "6d98eb95b450", "versionType": "custom"}, {"lessThan": "aaef73821a3b", "status": "affected", "version": "6d98eb95b450", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:*"], "defaultStatus": "affected", "product": "linux_kernel", "vendor": "linux", "versions": [{"status": "affected", "version": "5.17"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2DC0F822-2537-459C-B6B4-AFB7BE1CF445", "versionEndExcluding": "5.4.275", "versionStartIncluding": "5.4.226", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "533F4A36-7FFD-4A1F-9AA0-4B5D2B41B7C1", "versionEndExcluding": "5.10.216", "versionStartIncluding": "5.10.157", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2C224AF6-4425-43A8-9DFD-DC3014EB487E", "versionEndExcluding": "5.15.157", "versionStartIncluding": "5.15.17", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3E29B36A-C3F1-4464-8C44-1DD61018B22D", "versionEndExcluding": "6.1.88", "versionStartIncluding": "5.16.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0999E154-1E68-41FA-8DE3-9A735E382224", "versionEndExcluding": "6.6.29", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "673B3328-389D-41A4-9617-669298635262", "versionEndExcluding": "6.8.8", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*", "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*", "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*", "matchCriteriaId": "52048DDA-FC5A-4363-95A0-A6357B4D7F8C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*", "matchCriteriaId": "A06B2CCF-3F43-4FA9-8773-C83C3F5764B2", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: check offset alignment in binder_get_object()\n\nCommit 6d98eb95b450 (\"binder: avoid potential data leakage when copying\ntxn\") introduced changes to how binder objects are copied. In doing so,\nit unintentionally removed an offset alignment check done through calls\nto binder_alloc_copy_from_buffer() -> check_buffer().\n\nThese calls were replaced in binder_get_object() with copy_from_user(),\nso now an explicit offset alignment check is needed here. This avoids\nlater complications when unwinding the objects gets harder.\n\nIt is worth noting this check existed prior to commit 7a67a39320df\n(\"binder: add function to copy binder object from buffer\"), likely\nremoved due to redundancy at the time."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: Binder: verifique la alineaci\u00f3n de desplazamiento en binder_get_object() El commit 6d98eb95b450 (\"binder: evite posibles fugas de datos al copiar txn\") introdujo cambios en la forma en que se copian los objetos de Binder. Al hacerlo, elimin\u00f3 involuntariamente una verificaci\u00f3n de alineaci\u00f3n de desplazamiento realizada mediante llamadas a binder_alloc_copy_from_buffer() -> check_buffer(). Estas llamadas fueron reemplazadas en binder_get_object() con copy_from_user(), por lo que ahora se necesita aqu\u00ed una verificaci\u00f3n expl\u00edcita de alineaci\u00f3n de desplazamiento. Esto evita complicaciones posteriores cuando el desenrollado de los objetos se vuelve m\u00e1s dif\u00edcil. Vale la pena se\u00f1alar que esta verificaci\u00f3n exist\u00eda antes de el commit 7a67a39320df (\"carpeta: agregar funci\u00f3n para copiar el objeto de carpeta del b\u00fafer\"), probablemente eliminada debido a la redundancia en ese momento."}], "id": "CVE-2024-26926", "lastModified": "2026-08-04T11:17:22.813", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-26926", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-06-13T03:55:21.790532Z", "version": "2.0.3"}}]}, "published": "2024-04-25T06:15:57.780", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: binder: check offset alignment in binder_get_object()", "id": "2277173", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2277173"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1285", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbinder: check offset alignment in binder_get_object()\nCommit 6d98eb95b450 (\"binder: avoid potential data leakage when copying\ntxn\") introduced changes to how binder objects are copied. In doing so,\nit unintentionally removed an offset alignment check done through calls\nto binder_alloc_copy_from_buffer() -> check_buffer().\nThese calls were replaced in binder_get_object() with copy_from_user(),\nso now an explicit offset alignment check is needed here. This avoids\nlater complications when unwinding the objects gets harder.\nIt is worth noting this check existed prior to commit 7a67a39320df\n(\"binder: add function to copy binder object from buffer\"), likely\nremoved due to redundancy at the time."], "name": "CVE-2024-26926", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26926\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26926\nhttps://lore.kernel.org/linux-cve-announce/20240424232709.718930-2-lee@kernel.org/T"], "threat_severity": "Low"}

{}