CVE-2024-41026

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-41026", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.616Z", "datePublished": "2024-07-29T14:31:43.056Z", "dateUpdated": "2026-08-05T11:34:48.544Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:34:48.544Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: davinci_mmc: Prevent transmitted data size from exceeding sgm's length\n\nNo check is done on the size of the data to be transmiited. This causes\na kernel panic when this size exceeds the sg_miter's length.\n\nLimit the number of transmitted bytes to sgm->length."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable PIO path is reached through local device I/O \u2014 `MMC_IOC_CMD`/`MMC_IOC_MULTI_CMD` on the mmcblk block device or the RPMB character device \u2014 with no network or physical component required. No remote or adjacent-network protocol touches this driver.\nAC:L - The attacker deterministically selects `blksz`/`blocks` so that `blocks*blksz` is not a multiple of `rw_threshold`, which forces the PIO fallback in `mmc_davinci_prepare_data()` and makes the unclamped 32-byte priming transfer overrun a smaller scatterlist chunk on the first attempt. There is no race, no memory-layout guess, and no condition outside the attacker's control.\nPR:L - `mmc_rpmb_ioctl()` dispatches `MMC_IOC_CMD` into `mmc_blk_ioctl_cmd()` without any `capable()` check, so any user holding an open descriptor to `/dev/mmcblk*rpmb` \u2014 routinely group-accessible on embedded and Android-class deployments of this SoC family \u2014 can drive arbitrary `blksz`/`blocks` transfers. No administrative capability is needed on that path.\nUI:N - The attacker issues the ioctl directly against an already-present card; no victim action, card insertion, or mount is required.\nS:U - The out-of-bounds access corrupts and discloses kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - In the write direction the driver reads far past the end of the kmalloc'd/kmapped buffer and streams that kernel memory into the MMC data register, and the underflowed `bytes_left`/`__remaining` turn this into an effectively unbounded sequential read of kernel memory (data landing inside the programmed transfer window is persisted to attacker-controlled card storage and read back). This is not a bounded few-byte leak.\nI:H - The same missing clamp in the read direction writes card-supplied bytes past the destination chunk, and once `sg_miter`'s `__remaining`/`__offset` and `host->bytes_left` underflow the driver writes attacker-influenced data far beyond the mapped page \u2014 an out-of-bounds heap write suitable for corrupting adjacent slab objects.\nA:H - The commit message states outright that exceeding the sg_miter length causes a kernel panic; the underflowed `host->bytes_left` also drives a multi-gigabyte copy loop in hard IRQ context that faults off the end of the mapping, giving a reliable oops/lockup."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/mmc/host/davinci_mmc.c"], "versions": [{"version": "ed01d210fd910f7fa7933638df14ffb8d4aac2a9", "lessThan": "c561c4ecce712f94b442db5960e281f13b28df2e", "status": "affected", "versionType": "git"}, {"version": "ed01d210fd910f7fa7933638df14ffb8d4aac2a9", "lessThan": "16198eef11c1929374381d7f6271b4bf6aa44615", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/mmc/host/davinci_mmc.c"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.10", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.9.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c561c4ecce712f94b442db5960e281f13b28df2e"}, {"url": "https://git.kernel.org/stable/c/16198eef11c1929374381d7f6271b4bf6aa44615"}], "title": "mmc: davinci_mmc: Prevent transmitted data size from exceeding sgm's length", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:56.171Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/c561c4ecce712f94b442db5960e281f13b28df2e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/16198eef11c1929374381d7f6271b4bf6aa44615", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-41026", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:24:09.083090Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:04.488Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/c561c4ecce712f94b442db5960e281f13b28df2e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/16198eef11c1929374381d7f6271b4bf6aa44615", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:56.171Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-41026", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:24:09.083090Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:20.500Z"}}], "cna": {"title": "mmc: davinci_mmc: Prevent transmitted data size from exceeding sgm's length", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable PIO path is reached through local device I/O \u2014 `MMC_IOC_CMD`/`MMC_IOC_MULTI_CMD` on the mmcblk block device or the RPMB character device \u2014 with no network or physical component required. No remote or adjacent-network protocol touches this driver.\nAC:L - The attacker deterministically selects `blksz`/`blocks` so that `blocks*blksz` is not a multiple of `rw_threshold`, which forces the PIO fallback in `mmc_davinci_prepare_data()` and makes the unclamped 32-byte priming transfer overrun a smaller scatterlist chunk on the first attempt. There is no race, no memory-layout guess, and no condition outside the attacker's control.\nPR:L - `mmc_rpmb_ioctl()` dispatches `MMC_IOC_CMD` into `mmc_blk_ioctl_cmd()` without any `capable()` check, so any user holding an open descriptor to `/dev/mmcblk*rpmb` \u2014 routinely group-accessible on embedded and Android-class deployments of this SoC family \u2014 can drive arbitrary `blksz`/`blocks` transfers. No administrative capability is needed on that path.\nUI:N - The attacker issues the ioctl directly against an already-present card; no victim action, card insertion, or mount is required.\nS:U - The out-of-bounds access corrupts and discloses kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - In the write direction the driver reads far past the end of the kmalloc'd/kmapped buffer and streams that kernel memory into the MMC data register, and the underflowed `bytes_left`/`__remaining` turn this into an effectively unbounded sequential read of kernel memory (data landing inside the programmed transfer window is persisted to attacker-controlled card storage and read back). This is not a bounded few-byte leak.\nI:H - The same missing clamp in the read direction writes card-supplied bytes past the destination chunk, and once `sg_miter`'s `__remaining`/`__offset` and `host->bytes_left` underflow the driver writes attacker-influenced data far beyond the mapped page \u2014 an out-of-bounds heap write suitable for corrupting adjacent slab objects.\nA:H - The commit message states outright that exceeding the sg_miter length causes a kernel panic; the underflowed `host->bytes_left` also drives a multi-gigabyte copy loop in hard IRQ context that faults off the end of the mapping, giving a reliable oops/lockup."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ed01d210fd910f7fa7933638df14ffb8d4aac2a9", "lessThan": "c561c4ecce712f94b442db5960e281f13b28df2e", "versionType": "git"}, {"status": "affected", "version": "ed01d210fd910f7fa7933638df14ffb8d4aac2a9", "lessThan": "16198eef11c1929374381d7f6271b4bf6aa44615", "versionType": "git"}], "programFiles": ["drivers/mmc/host/davinci_mmc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"status": "unaffected", "version": "0", "lessThan": "6.9", "versionType": "semver"}, {"status": "unaffected", "version": "6.9.10", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/mmc/host/davinci_mmc.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/c561c4ecce712f94b442db5960e281f13b28df2e"}, {"url": "https://git.kernel.org/stable/c/16198eef11c1929374381d7f6271b4bf6aa44615"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: davinci_mmc: Prevent transmitted data size from exceeding sgm's length\n\nNo check is done on the size of the data to be transmiited. This causes\na kernel panic when this size exceeds the sg_miter's length.\n\nLimit the number of transmitted bytes to sgm->length."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.10", "versionStartIncluding": "6.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "6.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:34:48.544Z"}}}, "cveMetadata": {"cveId": "CVE-2024-41026", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:34:48.544Z", "dateReserved": "2024-07-12T12:17:45.616Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-29T14:31:43.056Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/mmc/host/davinci_mmc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c561c4ecce712f94b442db5960e281f13b28df2e", "status": "affected", "version": "ed01d210fd910f7fa7933638df14ffb8d4aac2a9", "versionType": "git"}, {"lessThan": "16198eef11c1929374381d7f6271b4bf6aa44615", "status": "affected", "version": "ed01d210fd910f7fa7933638df14ffb8d4aac2a9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/mmc/host/davinci_mmc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0F5C3789-472B-40EC-9D2A-48169EDB592B", "versionEndExcluding": "6.9.10", "versionStartIncluding": "6.9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*", "matchCriteriaId": "2EBB4392-5FA6-4DA9-9772-8F9C750109FA", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*", "matchCriteriaId": "331C2F14-12C7-45D5-893D-8C52EE38EA10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*", "matchCriteriaId": "3173713D-909A-4DD3-9DD4-1E171EB057EE", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*", "matchCriteriaId": "79F18AFA-40F7-43F0-BA30-7BDB65F918B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc5:*:*:*:*:*:*", "matchCriteriaId": "BD973AA4-A789-49BD-8D57-B2846935D3C7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc6:*:*:*:*:*:*", "matchCriteriaId": "8F3E9E0C-AC3E-4967-AF80-6483E8AB0078", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc7:*:*:*:*:*:*", "matchCriteriaId": "11AF4CB9-F697-4EA4-8903-8F9417EFDA8E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: davinci_mmc: Prevent transmitted data size from exceeding sgm's length\n\nNo check is done on the size of the data to be transmiited. This causes\na kernel panic when this size exceeds the sg_miter's length.\n\nLimit the number of transmitted bytes to sgm->length."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mmc: davinci_mmc: Evita que el tama\u00f1o de los datos transmitidos exceda la longitud de sgm No se realiza ninguna verificaci\u00f3n del tama\u00f1o de los datos a transmitir. Esto provoca un p\u00e1nico en el kernel cuando este tama\u00f1o excede la longitud de sg_miter. Limite el n\u00famero de bytes transmitidos a sgm->length."}], "id": "CVE-2024-41026", "lastModified": "2026-08-04T11:19:19.483", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-41026", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:24:09.083090Z", "version": "2.0.3"}}]}, "published": "2024-07-29T15:15:11.413", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/16198eef11c1929374381d7f6271b4bf6aa44615"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c561c4ecce712f94b442db5960e281f13b28df2e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/16198eef11c1929374381d7f6271b4bf6aa44615"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c561c4ecce712f94b442db5960e281f13b28df2e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: mmc: davinci_mmc: Prevent transmitted data size from exceeding sgm's length", "id": "2300384", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2300384"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "status": "draft"}, "cwe": "CWE-119", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmmc: davinci_mmc: Prevent transmitted data size from exceeding sgm's length\nNo check is done on the size of the data to be transmiited. This causes\na kernel panic when this size exceeds the sg_miter's length.\nLimit the number of transmitted bytes to sgm->length.", "A flaw was found in the `davinci_mmc` driver in the Linux kernel, which lacks validation for the size of transmitted data, leading to potential kernel panics if the data size exceeded the scatter-gather list (`sg_miter`) length. This issue was addressed by adding a check to limit the transmitted data to the `sgm->length`, preventing buffer overflows and enhancing system stability."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-41026", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-29T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-41026\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-41026\nhttps://lore.kernel.org/linux-cve-announce/2024072920-CVE-2024-41026-8de7@gregkh/T"], "statement": "Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.", "threat_severity": "Moderate"}

{"created": "2025-07-13T11:14:46.241851+00:00", "updated": "2025-07-13T11:14:46.241904+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}