CVE-2024-26659 (GCVE-0-2024-26659)

Vulnerability from cvelistv5 – Published: 2024-04-02 06:22 – Updated: 2026-08-05 11:26
VLAI
Title
xhci: handle isoc Babble and Buffer Overrun events properly
Summary
In the Linux kernel, the following vulnerability has been resolved: xhci: handle isoc Babble and Buffer Overrun events properly xHCI 4.9 explicitly forbids assuming that the xHC has released its ownership of a multi-TRB TD when it reports an error on one of the early TRBs. Yet the driver makes such assumption and releases the TD, allowing the remaining TRBs to be freed or overwritten by new TDs. The xHC should also report completion of the final TRB due to its IOC flag being set by us, regardless of prior errors. This event cannot be recognized if the TD has already been freed earlier, resulting in "Transfer event TRB DMA ptr not part of current TD" error message. Fix this by reusing the logic for processing isoc Transaction Errors. This also handles hosts which fail to report the final completion. Fix transfer length reporting on Babble errors. They may be caused by device malfunction, no guarantee that the buffer has been filled.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 04e51901dd44f40a5a385ced897f6bca87d5f40a , < 696e4112e5c1ee61996198f0ebb6ca3fab55166e (git)
Affected: 04e51901dd44f40a5a385ced897f6bca87d5f40a , < 2aa7bcfdbb46241c701811bbc0d64d7884e3346c (git)
Affected: 04e51901dd44f40a5a385ced897f6bca87d5f40a , < 2e3ec80ea7ba58bbb210e83b5a0afefee7c171d3 (git)
Affected: 04e51901dd44f40a5a385ced897f6bca87d5f40a , < f5e7ffa9269a448a720e21f1ed1384d118298c97 (git)
Affected: 04e51901dd44f40a5a385ced897f6bca87d5f40a , < 418456c0ce56209610523f21734c5612ee634134 (git)
Affected: 04e51901dd44f40a5a385ced897f6bca87d5f40a , < 7c4650ded49e5b88929ecbbb631efb8b0838e811 (git)
Create a notification for this product.
Linux Linux Affected: 2.6.36
Unaffected: 0 , < 2.6.36 (semver)
Unaffected: 5.10.213 , ≤ 5.10.* (semver)
Unaffected: 5.15.152 , ≤ 5.15.* (semver)
Unaffected: 6.1.82 , ≤ 6.1.* (semver)
Unaffected: 6.6.17 , ≤ 6.6.* (semver)
Unaffected: 6.7.5 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem Affected: 0 , < * (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26659",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T19:31:25.014647Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T19:31:33.585Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:12.454Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/696e4112e5c1ee61996198f0ebb6ca3fab55166e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2aa7bcfdbb46241c701811bbc0d64d7884e3346c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2e3ec80ea7ba58bbb210e83b5a0afefee7c171d3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f5e7ffa9269a448a720e21f1ed1384d118298c97"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/418456c0ce56209610523f21734c5612ee634134"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7c4650ded49e5b88929ecbbb631efb8b0838e811"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:49:25.643Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/host/xhci-ring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "696e4112e5c1ee61996198f0ebb6ca3fab55166e",
              "status": "affected",
              "version": "04e51901dd44f40a5a385ced897f6bca87d5f40a",
              "versionType": "git"
            },
            {
              "lessThan": "2aa7bcfdbb46241c701811bbc0d64d7884e3346c",
              "status": "affected",
              "version": "04e51901dd44f40a5a385ced897f6bca87d5f40a",
              "versionType": "git"
            },
            {
              "lessThan": "2e3ec80ea7ba58bbb210e83b5a0afefee7c171d3",
              "status": "affected",
              "version": "04e51901dd44f40a5a385ced897f6bca87d5f40a",
              "versionType": "git"
            },
            {
              "lessThan": "f5e7ffa9269a448a720e21f1ed1384d118298c97",
              "status": "affected",
              "version": "04e51901dd44f40a5a385ced897f6bca87d5f40a",
              "versionType": "git"
            },
            {
              "lessThan": "418456c0ce56209610523f21734c5612ee634134",
              "status": "affected",
              "version": "04e51901dd44f40a5a385ced897f6bca87d5f40a",
              "versionType": "git"
            },
            {
              "lessThan": "7c4650ded49e5b88929ecbbb631efb8b0838e811",
              "status": "affected",
              "version": "04e51901dd44f40a5a385ced897f6bca87d5f40a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/host/xhci-ring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.36"
            },
            {
              "lessThan": "2.6.36",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.213",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.213",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.152",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.82",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.17",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.5",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: handle isoc Babble and Buffer Overrun events properly\n\nxHCI 4.9 explicitly forbids assuming that the xHC has released its\nownership of a multi-TRB TD when it reports an error on one of the\nearly TRBs. Yet the driver makes such assumption and releases the TD,\nallowing the remaining TRBs to be freed or overwritten by new TDs.\n\nThe xHC should also report completion of the final TRB due to its IOC\nflag being set by us, regardless of prior errors. This event cannot\nbe recognized if the TD has already been freed earlier, resulting in\n\"Transfer event TRB DMA ptr not part of current TD\" error message.\n\nFix this by reusing the logic for processing isoc Transaction Errors.\nThis also handles hosts which fail to report the final completion.\n\nFix transfer length reporting on Babble errors. They may be caused by\ndevice malfunction, no guarantee that the buffer has been filled."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The buggy handler is reached by driving isochronous USB traffic from a local process \u2014 ALSA USB-audio, uvcvideo/V4L2, or raw usbfs `USBDEVFS_SUBMITURB` \u2014 on an already-attached device, with no physical access required. Consistent with the in-tree scoring of the analogous xhci isoc ring bugs (CVE-2025-37882, CVE-2025-22022).\nAC:L - `usb_submit_urb()` only bounds isoc frame lengths from above, so short isoc IN frames reliably provoke Isoch Buffer Overrun, and multi-TRB isoc TDs are the normal case for high-bandwidth SuperSpeed streams; the condition can be re-triggered every service interval. A malicious attached device can force babble deterministically.\nPR:L - Requires only an unprivileged local account with access to an isochronous USB endpoint (video/audio group membership or console-seat uaccess ACLs on /dev/bus/usb, /dev/video*, /dev/snd/*). No root or CAP_SYS_ADMIN is needed.\nUI:N - Once an isochronous-capable device is present, the attacker submits the URBs themselves; no victim action is required to trigger the premature TD giveback.\nS:U - The corruption and its impact are confined to the kernel\u0027s own memory and the xHCI host controller driver \u2014 the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The TD is released while the xHC still owns its remaining TRBs, so the controller keeps DMAing into a buffer that was given back and may be reallocated to another subsystem; that reallocated content is then reported back through the URB, and stale TRBs let the HC read reused memory \u2014 an arbitrary kernel-memory disclosure primitive.\nI:H - This is a use-after-free write: the xHC DMAs device-supplied data into freed/reallocated kernel memory, and freed TRB slots overwritten by new TDs let the controller act on torn TRBs with mismatched addresses and lengths, giving a corruption primitive leveragable for control-flow hijack.\nA:H - The missing final-TRB event produces \"Transfer event TRB DMA ptr not part of current TD\" and `-ESHUTDOWN`, desynchronizing driver and hardware and reaching `xhci_hc_died()`/`usb_hc_died()`, which kills every URB and all devices on the controller; the DMA-into-freed-memory and IOMMU-fault paths additionally cause kernel crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:26:35.521Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/696e4112e5c1ee61996198f0ebb6ca3fab55166e"
        },
        {
          "url": "https://git.kernel.org/stable/c/2aa7bcfdbb46241c701811bbc0d64d7884e3346c"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e3ec80ea7ba58bbb210e83b5a0afefee7c171d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5e7ffa9269a448a720e21f1ed1384d118298c97"
        },
        {
          "url": "https://git.kernel.org/stable/c/418456c0ce56209610523f21734c5612ee634134"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c4650ded49e5b88929ecbbb631efb8b0838e811"
        }
      ],
      "title": "xhci: handle isoc Babble and Buffer Overrun events properly",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26659",
    "datePublished": "2024-04-02T06:22:09.241Z",
    "dateReserved": "2024-02-19T14:20:24.147Z",
    "dateUpdated": "2026-08-05T11:26:35.521Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26659",
      "date": "2026-08-09",
      "epss": "0.0024",
      "percentile": "0.15066"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxhci: handle isoc Babble and Buffer Overrun events properly\\n\\nxHCI 4.9 explicitly forbids assuming that the xHC has released its\\nownership of a multi-TRB TD when it reports an error on one of the\\nearly TRBs. Yet the driver makes such assumption and releases the TD,\\nallowing the remaining TRBs to be freed or overwritten by new TDs.\\n\\nThe xHC should also report completion of the final TRB due to its IOC\\nflag being set by us, regardless of prior errors. This event cannot\\nbe recognized if the TD has already been freed earlier, resulting in\\n\\\"Transfer event TRB DMA ptr not part of current TD\\\" error message.\\n\\nFix this by reusing the logic for processing isoc Transaction Errors.\\nThis also handles hosts which fail to report the final completion.\\n\\nFix transfer length reporting on Babble errors. They may be caused by\\ndevice malfunction, no guarantee that the buffer has been filled.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: xhci: maneja correctamente los eventos isoc Babble y Buffer Overrun xHCI 4.9 proh\\u00edbe expl\\u00edcitamente suponer que xHC ha liberado su propiedad de un TD multi-TRB cuando informa un error en uno de los primeros TRB. Sin embargo, el conductor hace tal suposici\\u00f3n y libera el TD, permitiendo que los TRB restantes sean liberados o sobrescritos por nuevos TD. El xHC tambi\\u00e9n debe informar la finalizaci\\u00f3n del TRB final debido a que nosotros establecimos la bandera del COI, independientemente de los errores anteriores. Este evento no se puede reconocer si el TD ya se liber\\u00f3 anteriormente, lo que genera el mensaje de error \\\"Evento de transferencia TRB DMA ptr no forma parte del TD actual\\\". Solucione este problema reutilizando la l\\u00f3gica para procesar errores de transacci\\u00f3n isoc. Esto tambi\\u00e9n maneja los hosts que no informan la finalizaci\\u00f3n final. Se corrigi\\u00f3 el informe de duraci\\u00f3n de la transferencia sobre errores de Babble. Pueden deberse a un mal funcionamiento del dispositivo, no hay garant\\u00eda de que se haya llenado el b\\u00fafer.\"}]",
      "id": "CVE-2024-26659",
      "lastModified": "2024-11-21T09:02:47.073",
      "published": "2024-04-02T07:15:42.980",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/2aa7bcfdbb46241c701811bbc0d64d7884e3346c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/2e3ec80ea7ba58bbb210e83b5a0afefee7c171d3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/418456c0ce56209610523f21734c5612ee634134\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/696e4112e5c1ee61996198f0ebb6ca3fab55166e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/7c4650ded49e5b88929ecbbb631efb8b0838e811\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f5e7ffa9269a448a720e21f1ed1384d118298c97\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/2aa7bcfdbb46241c701811bbc0d64d7884e3346c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/2e3ec80ea7ba58bbb210e83b5a0afefee7c171d3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/418456c0ce56209610523f21734c5612ee634134\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/696e4112e5c1ee61996198f0ebb6ca3fab55166e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/7c4650ded49e5b88929ecbbb631efb8b0838e811\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/f5e7ffa9269a448a720e21f1ed1384d118298c97\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26659\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-02T07:15:42.980\",\"lastModified\":\"2026-08-04T11:16:54.247\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxhci: handle isoc Babble and Buffer Overrun events properly\\n\\nxHCI 4.9 explicitly forbids assuming that the xHC has released its\\nownership of a multi-TRB TD when it reports an error on one of the\\nearly TRBs. Yet the driver makes such assumption and releases the TD,\\nallowing the remaining TRBs to be freed or overwritten by new TDs.\\n\\nThe xHC should also report completion of the final TRB due to its IOC\\nflag being set by us, regardless of prior errors. This event cannot\\nbe recognized if the TD has already been freed earlier, resulting in\\n\\\"Transfer event TRB DMA ptr not part of current TD\\\" error message.\\n\\nFix this by reusing the logic for processing isoc Transaction Errors.\\nThis also handles hosts which fail to report the final completion.\\n\\nFix transfer length reporting on Babble errors. They may be caused by\\ndevice malfunction, no guarantee that the buffer has been filled.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: xhci: maneja correctamente los eventos isoc Babble y Buffer Overrun xHCI 4.9 proh\u00edbe expl\u00edcitamente suponer que xHC ha liberado su propiedad de un TD multi-TRB cuando informa un error en uno de los primeros TRB. Sin embargo, el conductor hace tal suposici\u00f3n y libera el TD, permitiendo que los TRB restantes sean liberados o sobrescritos por nuevos TD. El xHC tambi\u00e9n debe informar la finalizaci\u00f3n del TRB final debido a que nosotros establecimos la bandera del COI, independientemente de los errores anteriores. Este evento no se puede reconocer si el TD ya se liber\u00f3 anteriormente, lo que genera el mensaje de error \\\"Evento de transferencia TRB DMA ptr no forma parte del TD actual\\\". Solucione este problema reutilizando la l\u00f3gica para procesar errores de transacci\u00f3n isoc. Esto tambi\u00e9n maneja los hosts que no informan la finalizaci\u00f3n final. Se corrigi\u00f3 el informe de duraci\u00f3n de la transferencia sobre errores de Babble. Pueden deberse a un mal funcionamiento del dispositivo, no hay garant\u00eda de que se haya llenado el b\u00fafer.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/usb/host/xhci-ring.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"04e51901dd44f40a5a385ced897f6bca87d5f40a\",\"lessThan\":\"696e4112e5c1ee61996198f0ebb6ca3fab55166e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04e51901dd44f40a5a385ced897f6bca87d5f40a\",\"lessThan\":\"2aa7bcfdbb46241c701811bbc0d64d7884e3346c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04e51901dd44f40a5a385ced897f6bca87d5f40a\",\"lessThan\":\"2e3ec80ea7ba58bbb210e83b5a0afefee7c171d3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04e51901dd44f40a5a385ced897f6bca87d5f40a\",\"lessThan\":\"f5e7ffa9269a448a720e21f1ed1384d118298c97\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04e51901dd44f40a5a385ced897f6bca87d5f40a\",\"lessThan\":\"418456c0ce56209610523f21734c5612ee634134\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04e51901dd44f40a5a385ced897f6bca87d5f40a\",\"lessThan\":\"7c4650ded49e5b88929ecbbb631efb8b0838e811\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/usb/host/xhci-ring.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.36\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.36\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.213\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.152\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.82\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.17\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.5\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-17T19:31:25.014647Z\",\"id\":\"CVE-2024-26659\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.10.213\",\"matchCriteriaId\":\"399AEFF4-C09A-4528-9E27-F0E13AF7CC8B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.152\",\"matchCriteriaId\":\"DBBE9241-559E-479A-895A-02186BA03EBF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.82\",\"matchCriteriaId\":\"933AC628-7DAD-4B2D-82E3-3B7B331B1C09\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.17\",\"matchCriteriaId\":\"73F8C6ED-5A0B-4B25-8FA9-AF916A9C8F0B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.5\",\"matchCriteriaId\":\"01925741-2C95-47C1-A7EA-3DC2BB0012D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2aa7bcfdbb46241c701811bbc0d64d7884e3346c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2e3ec80ea7ba58bbb210e83b5a0afefee7c171d3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/418456c0ce56209610523f21734c5612ee634134\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/696e4112e5c1ee61996198f0ebb6ca3fab55166e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7c4650ded49e5b88929ecbbb631efb8b0838e811\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f5e7ffa9269a448a720e21f1ed1384d118298c97\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2aa7bcfdbb46241c701811bbc0d64d7884e3346c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2e3ec80ea7ba58bbb210e83b5a0afefee7c171d3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/418456c0ce56209610523f21734c5612ee634134\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/696e4112e5c1ee61996198f0ebb6ca3fab55166e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7c4650ded49e5b88929ecbbb631efb8b0838e811\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f5e7ffa9269a448a720e21f1ed1384d118298c97\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:49:55+00:00",
      "cve": "CVE-2024-26659",
      "id": "CVE-2024-26659",
      "initial_release_date": "2024-04-02T00:00:00+00:00",
      "product_status:fixed": "429",
      "product_status:known_affected": "150",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xhci: handle isoc Babble and Buffer Overrun events properly",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26659.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-15T19:49:15Z",
      "cve": "CVE-2024-26659",
      "id": "CVE-2024-26659",
      "initial_release_date": "2024-04-05T02:21:26Z",
      "product_status:known_affected": "552",
      "product_status:known_not_affected": "153",
      "product_status:recommended": "581",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26659",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26659.json",
      "version": "89"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/696e4112e5c1ee61996198f0ebb6ca3fab55166e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2aa7bcfdbb46241c701811bbc0d64d7884e3346c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2e3ec80ea7ba58bbb210e83b5a0afefee7c171d3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f5e7ffa9269a448a720e21f1ed1384d118298c97\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/418456c0ce56209610523f21734c5612ee634134\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7c4650ded49e5b88929ecbbb631efb8b0838e811\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:12.454Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-05-12T11:49:25.643Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26659\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-17T19:31:25.014647Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-17T19:31:30.867Z\"}}], \"cna\": {\"title\": \"xhci: handle isoc Babble and Buffer Overrun events properly\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The buggy handler is reached by driving isochronous USB traffic from a local process \\u2014 ALSA USB-audio, uvcvideo/V4L2, or raw usbfs `USBDEVFS_SUBMITURB` \\u2014 on an already-attached device, with no physical access required. Consistent with the in-tree scoring of the analogous xhci isoc ring bugs (CVE-2025-37882, CVE-2025-22022).\\nAC:L - `usb_submit_urb()` only bounds isoc frame lengths from above, so short isoc IN frames reliably provoke Isoch Buffer Overrun, and multi-TRB isoc TDs are the normal case for high-bandwidth SuperSpeed streams; the condition can be re-triggered every service interval. A malicious attached device can force babble deterministically.\\nPR:L - Requires only an unprivileged local account with access to an isochronous USB endpoint (video/audio group membership or console-seat uaccess ACLs on /dev/bus/usb, /dev/video*, /dev/snd/*). No root or CAP_SYS_ADMIN is needed.\\nUI:N - Once an isochronous-capable device is present, the attacker submits the URBs themselves; no victim action is required to trigger the premature TD giveback.\\nS:U - The corruption and its impact are confined to the kernel\u0027s own memory and the xHCI host controller driver \\u2014 the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The TD is released while the xHC still owns its remaining TRBs, so the controller keeps DMAing into a buffer that was given back and may be reallocated to another subsystem; that reallocated content is then reported back through the URB, and stale TRBs let the HC read reused memory \\u2014 an arbitrary kernel-memory disclosure primitive.\\nI:H - This is a use-after-free write: the xHC DMAs device-supplied data into freed/reallocated kernel memory, and freed TRB slots overwritten by new TDs let the controller act on torn TRBs with mismatched addresses and lengths, giving a corruption primitive leveragable for control-flow hijack.\\nA:H - The missing final-TRB event produces \\\"Transfer event TRB DMA ptr not part of current TD\\\" and `-ESHUTDOWN`, desynchronizing driver and hardware and reaching `xhci_hc_died()`/`usb_hc_died()`, which kills every URB and all devices on the controller; the DMA-into-freed-memory and IOMMU-fault paths additionally cause kernel crashes.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"04e51901dd44f40a5a385ced897f6bca87d5f40a\", \"lessThan\": \"696e4112e5c1ee61996198f0ebb6ca3fab55166e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"04e51901dd44f40a5a385ced897f6bca87d5f40a\", \"lessThan\": \"2aa7bcfdbb46241c701811bbc0d64d7884e3346c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"04e51901dd44f40a5a385ced897f6bca87d5f40a\", \"lessThan\": \"2e3ec80ea7ba58bbb210e83b5a0afefee7c171d3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"04e51901dd44f40a5a385ced897f6bca87d5f40a\", \"lessThan\": \"f5e7ffa9269a448a720e21f1ed1384d118298c97\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"04e51901dd44f40a5a385ced897f6bca87d5f40a\", \"lessThan\": \"418456c0ce56209610523f21734c5612ee634134\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"04e51901dd44f40a5a385ced897f6bca87d5f40a\", \"lessThan\": \"7c4650ded49e5b88929ecbbb631efb8b0838e811\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/usb/host/xhci-ring.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.36\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.36\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.213\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.152\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.82\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.17\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/usb/host/xhci-ring.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/696e4112e5c1ee61996198f0ebb6ca3fab55166e\"}, {\"url\": \"https://git.kernel.org/stable/c/2aa7bcfdbb46241c701811bbc0d64d7884e3346c\"}, {\"url\": \"https://git.kernel.org/stable/c/2e3ec80ea7ba58bbb210e83b5a0afefee7c171d3\"}, {\"url\": \"https://git.kernel.org/stable/c/f5e7ffa9269a448a720e21f1ed1384d118298c97\"}, {\"url\": \"https://git.kernel.org/stable/c/418456c0ce56209610523f21734c5612ee634134\"}, {\"url\": \"https://git.kernel.org/stable/c/7c4650ded49e5b88929ecbbb631efb8b0838e811\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxhci: handle isoc Babble and Buffer Overrun events properly\\n\\nxHCI 4.9 explicitly forbids assuming that the xHC has released its\\nownership of a multi-TRB TD when it reports an error on one of the\\nearly TRBs. Yet the driver makes such assumption and releases the TD,\\nallowing the remaining TRBs to be freed or overwritten by new TDs.\\n\\nThe xHC should also report completion of the final TRB due to its IOC\\nflag being set by us, regardless of prior errors. This event cannot\\nbe recognized if the TD has already been freed earlier, resulting in\\n\\\"Transfer event TRB DMA ptr not part of current TD\\\" error message.\\n\\nFix this by reusing the logic for processing isoc Transaction Errors.\\nThis also handles hosts which fail to report the final completion.\\n\\nFix transfer length reporting on Babble errors. They may be caused by\\ndevice malfunction, no guarantee that the buffer has been filled.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.213\", \"versionStartIncluding\": \"2.6.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.152\", \"versionStartIncluding\": \"2.6.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.82\", \"versionStartIncluding\": \"2.6.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.17\", \"versionStartIncluding\": \"2.6.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.5\", \"versionStartIncluding\": \"2.6.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"2.6.36\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:26:35.521Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26659\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:26:35.521Z\", \"dateReserved\": \"2024-02-19T14:20:24.147Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-02T06:22:09.241Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.