CVE-2024-26823 (GCVE-0-2024-26823)

Vulnerability from cvelistv5 – Published: 2024-04-17 09:43 – Updated: 2026-08-05 11:27
VLAI
Title
irqchip/gic-v3-its: Restore quirk probing for ACPI-based systems
Summary
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Restore quirk probing for ACPI-based systems While refactoring the way the ITSs are probed, the handling of quirks applicable to ACPI-based platforms was lost. As a result, systems such as HIP07 lose their GICv4 functionnality, and some other may even fail to boot, unless they are configured to boot with DT. Move the enabling of quirks into its_probe_one(), making it common to all firmware implementations.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:49 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9585a495ac936049dba141e8f9d99159ca06d46a , < 91a80fff3eeed928b6fba21271f6a9719b22a5d8 (git)
Affected: 9585a495ac936049dba141e8f9d99159ca06d46a , < 4c60c611441f1f1e5de8e00e98ee5a4970778a00 (git)
Affected: 9585a495ac936049dba141e8f9d99159ca06d46a , < 8b02da04ad978827e5ccd675acf170198f747a7a (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.18 , ≤ 6.6.* (semver)
Unaffected: 6.7.6 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.578Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/91a80fff3eeed928b6fba21271f6a9719b22a5d8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4c60c611441f1f1e5de8e00e98ee5a4970778a00"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8b02da04ad978827e5ccd675acf170198f747a7a"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26823",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:49:07.318138Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:32.102Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/irqchip/irq-gic-v3-its.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "91a80fff3eeed928b6fba21271f6a9719b22a5d8",
              "status": "affected",
              "version": "9585a495ac936049dba141e8f9d99159ca06d46a",
              "versionType": "git"
            },
            {
              "lessThan": "4c60c611441f1f1e5de8e00e98ee5a4970778a00",
              "status": "affected",
              "version": "9585a495ac936049dba141e8f9d99159ca06d46a",
              "versionType": "git"
            },
            {
              "lessThan": "8b02da04ad978827e5ccd675acf170198f747a7a",
              "status": "affected",
              "version": "9585a495ac936049dba141e8f9d99159ca06d46a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/irqchip/irq-gic-v3-its.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.18",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.6",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v3-its: Restore quirk probing for ACPI-based systems\n\nWhile refactoring the way the ITSs are probed, the handling of quirks\napplicable to ACPI-based platforms was lost. As a result, systems such as\nHIP07 lose their GICv4 functionnality, and some other may even fail to\nboot, unless they are configured to boot with DT.\n\nMove the enabling of quirks into its_probe_one(), making it common to all\nfirmware implementations."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw lives in ARM64 GICv3 ITS irqchip initialization and manifests through local ITS/MSI configuration and device probe; there is no network- or remote-facing input that reaches `its_probe_one()` or `its_create_device()`. Impact requires presence on the affected machine, so the vector is Local.\nAC:L - On any ACPI-booted system the quirk call is unconditionally absent from `gic_acpi_parse_madt_its()`, so every ITS is probed without its errata workarounds every boot \u2014 the defect is fully deterministic, involving no race, no memory-layout dependency, and no condition that must happen to align.\nPR:L - No authentication gate or capability check exists on the path \u2014 the ITS is misprogrammed during boot and the undersized-ITT overrun occurs through ordinary MSI/MSI-X allocation \u2014 but an actor must be locally present on the affected host; there is no unauthenticated remote or anonymous path.\nUI:N - The quirks are skipped automatically during early kernel init on every ACPI boot, and the resulting ITT undersizing and interrupt misdelivery occur during normal device probe with no victim action required.\nS:U - The out-of-bounds ITE writes, the misdirected VMAPP/VMOVP targeting, and the boot failure all occur within the kernel\u0027s own security authority; no IOMMU, hypervisor, or sandbox boundary is bypassed.\nC:H - The ITS writes 16-byte ITEs into a heap buffer sized for 8-byte entries, corrupting adjacent kernel objects; such heap corruption of neighboring pointer/length fields is leverageable for kernel memory disclosure, which the guidance scores as High.\nI:H - Losing the QDF2400 E0065 workaround re-introduces documented kernel memory corruption \u2014 the ITS DMA-writes ITEs past the end of the `kzalloc_node()`-allocated ITT into unrelated kernel heap \u2014 and the missing HIP07 `vlpi_redist_offset` makes the ITS target the wrong redistributor page.\nA:H - The commit states affected systems \"may even fail to boot\" and that HIP07 loses GICv4 entirely; combined with lost/misrouted interrupts on multi-socket ThunderX and heap corruption from the undersized ITT, the result is complete system unavailability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:27:38.274Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/91a80fff3eeed928b6fba21271f6a9719b22a5d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c60c611441f1f1e5de8e00e98ee5a4970778a00"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b02da04ad978827e5ccd675acf170198f747a7a"
        }
      ],
      "title": "irqchip/gic-v3-its: Restore quirk probing for ACPI-based systems",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26823",
    "datePublished": "2024-04-17T09:43:49.850Z",
    "dateReserved": "2024-02-19T14:20:24.180Z",
    "dateUpdated": "2026-08-05T11:27:38.274Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26823",
      "date": "2026-08-21",
      "epss": "0.00234",
      "percentile": "0.14592"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nirqchip/gic-v3-its: Restore quirk probing for ACPI-based systems\\n\\nWhile refactoring the way the ITSs are probed, the handling of quirks\\napplicable to ACPI-based platforms was lost. As a result, systems such as\\nHIP07 lose their GICv4 functionnality, and some other may even fail to\\nboot, unless they are configured to boot with DT.\\n\\nMove the enabling of quirks into its_probe_one(), making it common to all\\nfirmware implementations.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: irqchip/gic-v3-its: restaurar el sondeo de peculiaridades para sistemas basados en ACPI Al refactorizar la forma en que se sondean los ITS, se perdi\\u00f3 el manejo de peculiaridades aplicables a plataformas basadas en ACPI. Como resultado, sistemas como HIP07 pierden su funcionalidad GICv4 y es posible que algunos otros incluso no arranquen, a menos que est\\u00e9n configurados para arrancar con DT. Mueva la habilitaci\\u00f3n de peculiaridades a its_probe_one(), haci\\u00e9ndola com\\u00fan a todas las implementaciones de firmware.\"}]",
      "id": "CVE-2024-26823",
      "lastModified": "2024-11-21T09:03:09.103",
      "published": "2024-04-17T10:15:09.027",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/4c60c611441f1f1e5de8e00e98ee5a4970778a00\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/8b02da04ad978827e5ccd675acf170198f747a7a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/91a80fff3eeed928b6fba21271f6a9719b22a5d8\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/4c60c611441f1f1e5de8e00e98ee5a4970778a00\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/8b02da04ad978827e5ccd675acf170198f747a7a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/91a80fff3eeed928b6fba21271f6a9719b22a5d8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26823\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-17T10:15:09.027\",\"lastModified\":\"2026-08-04T11:17:10.543\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nirqchip/gic-v3-its: Restore quirk probing for ACPI-based systems\\n\\nWhile refactoring the way the ITSs are probed, the handling of quirks\\napplicable to ACPI-based platforms was lost. As a result, systems such as\\nHIP07 lose their GICv4 functionnality, and some other may even fail to\\nboot, unless they are configured to boot with DT.\\n\\nMove the enabling of quirks into its_probe_one(), making it common to all\\nfirmware implementations.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: irqchip/gic-v3-its: restaurar el sondeo de peculiaridades para sistemas basados en ACPI Al refactorizar la forma en que se sondean los ITS, se perdi\u00f3 el manejo de peculiaridades aplicables a plataformas basadas en ACPI. Como resultado, sistemas como HIP07 pierden su funcionalidad GICv4 y es posible que algunos otros incluso no arranquen, a menos que est\u00e9n configurados para arrancar con DT. Mueva la habilitaci\u00f3n de peculiaridades a its_probe_one(), haci\u00e9ndola com\u00fan a todas las implementaciones de firmware.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/irqchip/irq-gic-v3-its.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9585a495ac936049dba141e8f9d99159ca06d46a\",\"lessThan\":\"91a80fff3eeed928b6fba21271f6a9719b22a5d8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9585a495ac936049dba141e8f9d99159ca06d46a\",\"lessThan\":\"4c60c611441f1f1e5de8e00e98ee5a4970778a00\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9585a495ac936049dba141e8f9d99159ca06d46a\",\"lessThan\":\"8b02da04ad978827e5ccd675acf170198f747a7a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/irqchip/irq-gic-v3-its.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.18\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.6\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T15:49:07.318138Z\",\"id\":\"CVE-2024-26823\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.6.18\",\"matchCriteriaId\":\"8ED485BB-BF8B-4D25-809B-B538663EA8D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.6\",\"matchCriteriaId\":\"C6D6A5C8-7308-42A9-8A72-ABF3DEA4BB82\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4c60c611441f1f1e5de8e00e98ee5a4970778a00\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8b02da04ad978827e5ccd675acf170198f747a7a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/91a80fff3eeed928b6fba21271f6a9719b22a5d8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4c60c611441f1f1e5de8e00e98ee5a4970778a00\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8b02da04ad978827e5ccd675acf170198f747a7a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/91a80fff3eeed928b6fba21271f6a9719b22a5d8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:50:37+00:00",
      "cve": "CVE-2024-26823",
      "id": "CVE-2024-26823",
      "initial_release_date": "2024-04-17T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: irqchip/gic-v3-its: Restore quirk probing for ACPI-based systems",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26823.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T16:56:36Z",
      "cve": "CVE-2024-26823",
      "id": "CVE-2024-26823",
      "initial_release_date": "2024-04-19T02:18:44Z",
      "product_status:known_not_affected": "311",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26823",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26823.json",
      "version": "18"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/91a80fff3eeed928b6fba21271f6a9719b22a5d8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4c60c611441f1f1e5de8e00e98ee5a4970778a00\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8b02da04ad978827e5ccd675acf170198f747a7a\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.578Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26823\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:49:07.318138Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:17.196Z\"}}], \"cna\": {\"title\": \"irqchip/gic-v3-its: Restore quirk probing for ACPI-based systems\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The flaw lives in ARM64 GICv3 ITS irqchip initialization and manifests through local ITS/MSI configuration and device probe; there is no network- or remote-facing input that reaches `its_probe_one()` or `its_create_device()`. Impact requires presence on the affected machine, so the vector is Local.\\nAC:L - On any ACPI-booted system the quirk call is unconditionally absent from `gic_acpi_parse_madt_its()`, so every ITS is probed without its errata workarounds every boot \\u2014 the defect is fully deterministic, involving no race, no memory-layout dependency, and no condition that must happen to align.\\nPR:L - No authentication gate or capability check exists on the path \\u2014 the ITS is misprogrammed during boot and the undersized-ITT overrun occurs through ordinary MSI/MSI-X allocation \\u2014 but an actor must be locally present on the affected host; there is no unauthenticated remote or anonymous path.\\nUI:N - The quirks are skipped automatically during early kernel init on every ACPI boot, and the resulting ITT undersizing and interrupt misdelivery occur during normal device probe with no victim action required.\\nS:U - The out-of-bounds ITE writes, the misdirected VMAPP/VMOVP targeting, and the boot failure all occur within the kernel\u0027s own security authority; no IOMMU, hypervisor, or sandbox boundary is bypassed.\\nC:H - The ITS writes 16-byte ITEs into a heap buffer sized for 8-byte entries, corrupting adjacent kernel objects; such heap corruption of neighboring pointer/length fields is leverageable for kernel memory disclosure, which the guidance scores as High.\\nI:H - Losing the QDF2400 E0065 workaround re-introduces documented kernel memory corruption \\u2014 the ITS DMA-writes ITEs past the end of the `kzalloc_node()`-allocated ITT into unrelated kernel heap \\u2014 and the missing HIP07 `vlpi_redist_offset` makes the ITS target the wrong redistributor page.\\nA:H - The commit states affected systems \\\"may even fail to boot\\\" and that HIP07 loses GICv4 entirely; combined with lost/misrouted interrupts on multi-socket ThunderX and heap corruption from the undersized ITT, the result is complete system unavailability.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9585a495ac936049dba141e8f9d99159ca06d46a\", \"lessThan\": \"91a80fff3eeed928b6fba21271f6a9719b22a5d8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9585a495ac936049dba141e8f9d99159ca06d46a\", \"lessThan\": \"4c60c611441f1f1e5de8e00e98ee5a4970778a00\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9585a495ac936049dba141e8f9d99159ca06d46a\", \"lessThan\": \"8b02da04ad978827e5ccd675acf170198f747a7a\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/irqchip/irq-gic-v3-its.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.18\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/irqchip/irq-gic-v3-its.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/91a80fff3eeed928b6fba21271f6a9719b22a5d8\"}, {\"url\": \"https://git.kernel.org/stable/c/4c60c611441f1f1e5de8e00e98ee5a4970778a00\"}, {\"url\": \"https://git.kernel.org/stable/c/8b02da04ad978827e5ccd675acf170198f747a7a\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nirqchip/gic-v3-its: Restore quirk probing for ACPI-based systems\\n\\nWhile refactoring the way the ITSs are probed, the handling of quirks\\napplicable to ACPI-based platforms was lost. As a result, systems such as\\nHIP07 lose their GICv4 functionnality, and some other may even fail to\\nboot, unless they are configured to boot with DT.\\n\\nMove the enabling of quirks into its_probe_one(), making it common to all\\nfirmware implementations.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.18\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.6\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"6.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:27:38.274Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26823\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:27:38.274Z\", \"dateReserved\": \"2024-02-19T14:20:24.180Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-17T09:43:49.850Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.