CVE-2024-26926 (GCVE-0-2024-26926)
Vulnerability from cvelistv5 – Published: 2024-04-24 23:23 – Updated: 2026-08-05 11:28
VLAI
EPSS
VEX
Title
binder: check offset alignment in binder_get_object()
Summary
In the Linux kernel, the following vulnerability has been resolved:
binder: check offset alignment in binder_get_object()
Commit 6d98eb95b450 ("binder: avoid potential data leakage when copying
txn") introduced changes to how binder objects are copied. In doing so,
it unintentionally removed an offset alignment check done through calls
to binder_alloc_copy_from_buffer() -> check_buffer().
These calls were replaced in binder_get_object() with copy_from_user(),
so now an explicit offset alignment check is needed here. This avoids
later complications when unwinding the objects gets harder.
It is worth noting this check existed prior to commit 7a67a39320df
("binder: add function to copy binder object from buffer"), likely
removed due to redundancy at the time.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-13 03:55 UTC
Assigner
References
8 references
Impacted products
4 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
c056a6ba35e00ae943e377eb09abd77a6915b31a , < 68a28f551e4690db2b27b3db716c7395f6fada12
(git)
Affected: 23e9d815fad84c1bee3742a8de4bd39510435362 , < 48a1f83ca9c68518b1a783c62e6a8223144fa9fc (git) Affected: 7a9ad4aceb0226b391c9d3b8e4ac2e7d438b6bde , < a2fd6dbc98be1105a1d8e9e31575da8873ef115c (git) Affected: 6d98eb95b450a75adb4516a1d33652dc78d2b20c , < a6d2a8b211c874971ee4cf3ddd167408177f6e76 (git) Affected: 6d98eb95b450a75adb4516a1d33652dc78d2b20c , < 1d7f1049035b2060342f11eff957cf567d810bdc (git) Affected: 6d98eb95b450a75adb4516a1d33652dc78d2b20c , < f01d6619045704d78613b14e2e0420bfdb7f1c15 (git) Affected: 6d98eb95b450a75adb4516a1d33652dc78d2b20c , < aaef73821a3b0194a01bd23ca77774f704a04d40 (git) Affected: 66e12f5b3a9733f941893a00753b10498724607d (git) Affected: 5.4.226 , < 5.4.275 (semver) Affected: 5.10.157 , < 5.10.216 (semver) Affected: 5.15.17 , < 5.15.157 (semver) Affected: 5.16.3 , < 5.17 (semver) |
guessed | |
| Linux | Linux |
Affected:
5.17
Unaffected: 0 , < 5.17 (semver) Unaffected: 5.4.275 , ≤ 5.4.* (semver) Unaffected: 5.10.216 , ≤ 5.10.* (semver) Unaffected: 5.15.157 , ≤ 5.15.* (semver) Unaffected: 6.1.88 , ≤ 6.1.* (semver) Unaffected: 6.6.29 , ≤ 6.6.* (semver) Unaffected: 6.8.8 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix) |
guessed | |
| linux | linux_kernel |
Affected:
c056a6ba35e0 , < 68a28f551e46
(custom)
Affected: 23e9d815fad8 , < 48a1f83ca9c6 (custom) Affected: 7a9ad4aceb02 , < a2fd6dbc98be (custom) Affected: 6d98eb95b450 , < a6d2a8b211c8 (custom) Affected: 6d98eb95b450 , < 1d7f1049035b (custom) Affected: 6d98eb95b450 , < f01d66190457 (custom) Affected: 6d98eb95b450 , < aaef73821a3b (custom) cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* |
||
| linux | linux_kernel |
Affected:
5.17
cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "linux_kernel",
"vendor": "linux",
"versions": [
{
"lessThan": "68a28f551e46",
"status": "affected",
"version": "c056a6ba35e0",
"versionType": "custom"
},
{
"lessThan": "48a1f83ca9c6",
"status": "affected",
"version": "23e9d815fad8",
"versionType": "custom"
},
{
"lessThan": "a2fd6dbc98be",
"status": "affected",
"version": "7a9ad4aceb02",
"versionType": "custom"
},
{
"lessThan": "a6d2a8b211c8",
"status": "affected",
"version": "6d98eb95b450",
"versionType": "custom"
},
{
"lessThan": "1d7f1049035b",
"status": "affected",
"version": "6d98eb95b450",
"versionType": "custom"
},
{
"lessThan": "f01d66190457",
"status": "affected",
"version": "6d98eb95b450",
"versionType": "custom"
},
{
"lessThan": "aaef73821a3b",
"status": "affected",
"version": "6d98eb95b450",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "linux_kernel",
"vendor": "linux",
"versions": [
{
"status": "affected",
"version": "5.17"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-26926",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-13T03:55:21.790532Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-13T14:39:55.884Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:21:05.552Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/android/binder.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "68a28f551e4690db2b27b3db716c7395f6fada12",
"status": "affected",
"version": "c056a6ba35e00ae943e377eb09abd77a6915b31a",
"versionType": "git"
},
{
"lessThan": "48a1f83ca9c68518b1a783c62e6a8223144fa9fc",
"status": "affected",
"version": "23e9d815fad84c1bee3742a8de4bd39510435362",
"versionType": "git"
},
{
"lessThan": "a2fd6dbc98be1105a1d8e9e31575da8873ef115c",
"status": "affected",
"version": "7a9ad4aceb0226b391c9d3b8e4ac2e7d438b6bde",
"versionType": "git"
},
{
"lessThan": "a6d2a8b211c874971ee4cf3ddd167408177f6e76",
"status": "affected",
"version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
"versionType": "git"
},
{
"lessThan": "1d7f1049035b2060342f11eff957cf567d810bdc",
"status": "affected",
"version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
"versionType": "git"
},
{
"lessThan": "f01d6619045704d78613b14e2e0420bfdb7f1c15",
"status": "affected",
"version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
"versionType": "git"
},
{
"lessThan": "aaef73821a3b0194a01bd23ca77774f704a04d40",
"status": "affected",
"version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
"versionType": "git"
},
{
"status": "affected",
"version": "66e12f5b3a9733f941893a00753b10498724607d",
"versionType": "git"
},
{
"lessThan": "5.4.275",
"status": "affected",
"version": "5.4.226",
"versionType": "semver"
},
{
"lessThan": "5.10.216",
"status": "affected",
"version": "5.10.157",
"versionType": "semver"
},
{
"lessThan": "5.15.157",
"status": "affected",
"version": "5.15.17",
"versionType": "semver"
},
{
"lessThan": "5.17",
"status": "affected",
"version": "5.16.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/android/binder.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.275",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.29",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.8.*",
"status": "unaffected",
"version": "6.8.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.9",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.275",
"versionStartIncluding": "5.4.226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.216",
"versionStartIncluding": "5.10.157",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.157",
"versionStartIncluding": "5.15.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.88",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.29",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8.8",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.16.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: check offset alignment in binder_get_object()\n\nCommit 6d98eb95b450 (\"binder: avoid potential data leakage when copying\ntxn\") introduced changes to how binder objects are copied. In doing so,\nit unintentionally removed an offset alignment check done through calls\nto binder_alloc_copy_from_buffer() -\u003e check_buffer().\n\nThese calls were replaced in binder_get_object() with copy_from_user(),\nso now an explicit offset alignment check is needed here. This avoids\nlater complications when unwinding the objects gets harder.\n\nIt is worth noting this check existed prior to commit 7a67a39320df\n(\"binder: add function to copy binder object from buffer\"), likely\nremoved due to redundancy at the time."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached through `ioctl(BINDER_WRITE_READ)` with `BC_TRANSACTION` on `/dev/binder` or a binderfs device node, requiring local access to the system. There is no remote or adjacent-network path into `binder_transaction()`.\nAC:L - The attacker fully and deterministically controls the offsets array and the transaction payload, so supplying a misaligned offset triggers the flawed path on the first try with no race, timing, or memory-layout dependency.\nPR:L - Any unprivileged local process can drive this \u2014 on Android every installed app holds binder access by design, and on general-purpose kernels binderfs is `FS_USERNS_MOUNT` while `BINDER_SET_CONTEXT_MGR` carries no capability check, so an ordinary user can set up both sender and target inside `unshare -Urn`.\nUI:N - The attacker issues the malformed transaction entirely from its own process; no victim action, file open, or mount by another user is needed.\nS:U - The mismanaged state is binder driver data owned by the kernel, and impact remains within the kernel\u0027s own security authority rather than crossing a hypervisor, IOMMU, or sandbox boundary.\nC:H - Dropping the alignment guard lets an unprivileged process desynchronize binder\u0027s object accounting so that `binder_node`/`binder_ref` lifetimes are no longer correctly tracked by the driver\u0027s refcounting \u2014 the same protection that prevents stale-object access \u2014 and this class of binder bookkeeping flaw is the established route to kernel memory read primitives on Android.\nI:H - The attacker causes unauthorized, permanent modification of another process\u0027s binder reference table and of node reference counts, state the attacker has no right to alter, and the resulting lifetime-tracking inconsistency is memory-safety relevant and leveragable toward write primitives.\nA:H - Every malformed transaction leaks a `binder_node` plus a `binder_ref` that the unwind path can never reclaim, and the loop can be repeated without bound against a chosen victim process, driving unreclaimable kernel allocation to OOM on memory-constrained Android and embedded devices."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:28:24.537Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12"
},
{
"url": "https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc"
},
{
"url": "https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c"
},
{
"url": "https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76"
},
{
"url": "https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc"
},
{
"url": "https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15"
},
{
"url": "https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40"
}
],
"title": "binder: check offset alignment in binder_get_object()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-26926",
"datePublished": "2024-04-24T23:23:40.600Z",
"dateReserved": "2024-02-19T14:20:24.194Z",
"dateUpdated": "2026-08-05T11:28:24.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2024-26926",
"date": "2026-09-19",
"epss": "0.00444",
"percentile": "0.38001"
},
"fkie_nvd": {
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: check offset alignment in binder_get_object()\n\nCommit 6d98eb95b450 (\"binder: avoid potential data leakage when copying\ntxn\") introduced changes to how binder objects are copied. In doing so,\nit unintentionally removed an offset alignment check done through calls\nto binder_alloc_copy_from_buffer() -\u003e check_buffer().\n\nThese calls were replaced in binder_get_object() with copy_from_user(),\nso now an explicit offset alignment check is needed here. This avoids\nlater complications when unwinding the objects gets harder.\n\nIt is worth noting this check existed prior to commit 7a67a39320df\n(\"binder: add function to copy binder object from buffer\"), likely\nremoved due to redundancy at the time."
},
{
"lang": "es",
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: Binder: verifique la alineaci\u00f3n de desplazamiento en binder_get_object() El commit 6d98eb95b450 (\"binder: evite posibles fugas de datos al copiar txn\") introdujo cambios en la forma en que se copian los objetos de Binder. Al hacerlo, elimin\u00f3 involuntariamente una verificaci\u00f3n de alineaci\u00f3n de desplazamiento realizada mediante llamadas a binder_alloc_copy_from_buffer() -\u0026gt; check_buffer(). Estas llamadas fueron reemplazadas en binder_get_object() con copy_from_user(), por lo que ahora se necesita aqu\u00ed una verificaci\u00f3n expl\u00edcita de alineaci\u00f3n de desplazamiento. Esto evita complicaciones posteriores cuando el desenrollado de los objetos se vuelve m\u00e1s dif\u00edcil. Vale la pena se\u00f1alar que esta verificaci\u00f3n exist\u00eda antes de el commit 7a67a39320df (\"carpeta: agregar funci\u00f3n para copiar el objeto de carpeta del b\u00fafer\"), probablemente eliminada debido a la redundancia en ese momento."
}
],
"id": "CVE-2024-26926",
"lastModified": "2024-11-21T09:03:24.013",
"published": "2024-04-25T06:15:57.780",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Awaiting Analysis"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/android/binder.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "68a28f551e4690db2b27b3db716c7395f6fada12",
"status": "affected",
"version": "c056a6ba35e00ae943e377eb09abd77a6915b31a",
"versionType": "git"
},
{
"lessThan": "48a1f83ca9c68518b1a783c62e6a8223144fa9fc",
"status": "affected",
"version": "23e9d815fad84c1bee3742a8de4bd39510435362",
"versionType": "git"
},
{
"lessThan": "a2fd6dbc98be1105a1d8e9e31575da8873ef115c",
"status": "affected",
"version": "7a9ad4aceb0226b391c9d3b8e4ac2e7d438b6bde",
"versionType": "git"
},
{
"lessThan": "a6d2a8b211c874971ee4cf3ddd167408177f6e76",
"status": "affected",
"version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
"versionType": "git"
},
{
"lessThan": "1d7f1049035b2060342f11eff957cf567d810bdc",
"status": "affected",
"version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
"versionType": "git"
},
{
"lessThan": "f01d6619045704d78613b14e2e0420bfdb7f1c15",
"status": "affected",
"version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
"versionType": "git"
},
{
"lessThan": "aaef73821a3b0194a01bd23ca77774f704a04d40",
"status": "affected",
"version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
"versionType": "git"
},
{
"status": "affected",
"version": "66e12f5b3a9733f941893a00753b10498724607d",
"versionType": "git"
},
{
"lessThan": "5.4.275",
"status": "affected",
"version": "5.4.226",
"versionType": "semver"
},
{
"lessThan": "5.10.216",
"status": "affected",
"version": "5.10.157",
"versionType": "semver"
},
{
"lessThan": "5.15.157",
"status": "affected",
"version": "5.15.17",
"versionType": "semver"
},
{
"lessThan": "5.17",
"status": "affected",
"version": "5.16.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/android/binder.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.275",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.29",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.8.*",
"status": "unaffected",
"version": "6.8.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.9",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"affectedData": [
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "linux_kernel",
"vendor": "linux",
"versions": [
{
"lessThan": "68a28f551e46",
"status": "affected",
"version": "c056a6ba35e0",
"versionType": "custom"
},
{
"lessThan": "48a1f83ca9c6",
"status": "affected",
"version": "23e9d815fad8",
"versionType": "custom"
},
{
"lessThan": "a2fd6dbc98be",
"status": "affected",
"version": "7a9ad4aceb02",
"versionType": "custom"
},
{
"lessThan": "a6d2a8b211c8",
"status": "affected",
"version": "6d98eb95b450",
"versionType": "custom"
},
{
"lessThan": "1d7f1049035b",
"status": "affected",
"version": "6d98eb95b450",
"versionType": "custom"
},
{
"lessThan": "f01d66190457",
"status": "affected",
"version": "6d98eb95b450",
"versionType": "custom"
},
{
"lessThan": "aaef73821a3b",
"status": "affected",
"version": "6d98eb95b450",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "linux_kernel",
"vendor": "linux",
"versions": [
{
"status": "affected",
"version": "5.17"
}
]
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2DC0F822-2537-459C-B6B4-AFB7BE1CF445",
"versionEndExcluding": "5.4.275",
"versionStartIncluding": "5.4.226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "533F4A36-7FFD-4A1F-9AA0-4B5D2B41B7C1",
"versionEndExcluding": "5.10.216",
"versionStartIncluding": "5.10.157",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2C224AF6-4425-43A8-9DFD-DC3014EB487E",
"versionEndExcluding": "5.15.157",
"versionStartIncluding": "5.15.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3E29B36A-C3F1-4464-8C44-1DD61018B22D",
"versionEndExcluding": "6.1.88",
"versionStartIncluding": "5.16.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0999E154-1E68-41FA-8DE3-9A735E382224",
"versionEndExcluding": "6.6.29",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "673B3328-389D-41A4-9617-669298635262",
"versionEndExcluding": "6.8.8",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*",
"matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*",
"matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*",
"matchCriteriaId": "52048DDA-FC5A-4363-95A0-A6357B4D7F8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*",
"matchCriteriaId": "A06B2CCF-3F43-4FA9-8773-C83C3F5764B2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: check offset alignment in binder_get_object()\n\nCommit 6d98eb95b450 (\"binder: avoid potential data leakage when copying\ntxn\") introduced changes to how binder objects are copied. In doing so,\nit unintentionally removed an offset alignment check done through calls\nto binder_alloc_copy_from_buffer() -\u003e check_buffer().\n\nThese calls were replaced in binder_get_object() with copy_from_user(),\nso now an explicit offset alignment check is needed here. This avoids\nlater complications when unwinding the objects gets harder.\n\nIt is worth noting this check existed prior to commit 7a67a39320df\n(\"binder: add function to copy binder object from buffer\"), likely\nremoved due to redundancy at the time."
},
{
"lang": "es",
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: Binder: verifique la alineaci\u00f3n de desplazamiento en binder_get_object() El commit 6d98eb95b450 (\"binder: evite posibles fugas de datos al copiar txn\") introdujo cambios en la forma en que se copian los objetos de Binder. Al hacerlo, elimin\u00f3 involuntariamente una verificaci\u00f3n de alineaci\u00f3n de desplazamiento realizada mediante llamadas a binder_alloc_copy_from_buffer() -\u0026gt; check_buffer(). Estas llamadas fueron reemplazadas en binder_get_object() con copy_from_user(), por lo que ahora se necesita aqu\u00ed una verificaci\u00f3n expl\u00edcita de alineaci\u00f3n de desplazamiento. Esto evita complicaciones posteriores cuando el desenrollado de los objetos se vuelve m\u00e1s dif\u00edcil. Vale la pena se\u00f1alar que esta verificaci\u00f3n exist\u00eda antes de el commit 7a67a39320df (\"carpeta: agregar funci\u00f3n para copiar el objeto de carpeta del b\u00fafer\"), probablemente eliminada debido a la redundancia en ese momento."
}
],
"id": "CVE-2024-26926",
"lastModified": "2026-08-04T11:17:22.813",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-26926",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-13T03:55:21.790532Z",
"version": "2.0.3"
}
}
]
},
"published": "2024-04-25T06:15:57.780",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "Low",
"current_release_date": "2026-08-04T22:48:51+00:00",
"cve": "CVE-2024-26926",
"id": "CVE-2024-26926",
"initial_release_date": "2024-04-24T00:00:00+00:00",
"product_status:known_affected": "198",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: binder: check offset alignment in binder_get_object()",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26926.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-09-05T00:44:30Z",
"cve": "CVE-2024-26926",
"id": "CVE-2024-26926",
"initial_release_date": "2024-04-25T23:11:53Z",
"product_status:known_not_affected": "343",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2024-26926",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26926.json",
"version": "19"
},
"vulnrichment": {
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:21:05.552Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "linux_kernel",
"vendor": "linux",
"versions": [
{
"lessThan": "68a28f551e46",
"status": "affected",
"version": "c056a6ba35e0",
"versionType": "custom"
},
{
"lessThan": "48a1f83ca9c6",
"status": "affected",
"version": "23e9d815fad8",
"versionType": "custom"
},
{
"lessThan": "a2fd6dbc98be",
"status": "affected",
"version": "7a9ad4aceb02",
"versionType": "custom"
},
{
"lessThan": "a6d2a8b211c8",
"status": "affected",
"version": "6d98eb95b450",
"versionType": "custom"
},
{
"lessThan": "1d7f1049035b",
"status": "affected",
"version": "6d98eb95b450",
"versionType": "custom"
},
{
"lessThan": "f01d66190457",
"status": "affected",
"version": "6d98eb95b450",
"versionType": "custom"
},
{
"lessThan": "aaef73821a3b",
"status": "affected",
"version": "6d98eb95b450",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "linux_kernel",
"vendor": "linux",
"versions": [
{
"status": "affected",
"version": "5.17"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-26926",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-13T03:55:21.790532Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-13T14:39:51.124Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/android/binder.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "68a28f551e4690db2b27b3db716c7395f6fada12",
"status": "affected",
"version": "c056a6ba35e00ae943e377eb09abd77a6915b31a",
"versionType": "git"
},
{
"lessThan": "48a1f83ca9c68518b1a783c62e6a8223144fa9fc",
"status": "affected",
"version": "23e9d815fad84c1bee3742a8de4bd39510435362",
"versionType": "git"
},
{
"lessThan": "a2fd6dbc98be1105a1d8e9e31575da8873ef115c",
"status": "affected",
"version": "7a9ad4aceb0226b391c9d3b8e4ac2e7d438b6bde",
"versionType": "git"
},
{
"lessThan": "a6d2a8b211c874971ee4cf3ddd167408177f6e76",
"status": "affected",
"version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
"versionType": "git"
},
{
"lessThan": "1d7f1049035b2060342f11eff957cf567d810bdc",
"status": "affected",
"version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
"versionType": "git"
},
{
"lessThan": "f01d6619045704d78613b14e2e0420bfdb7f1c15",
"status": "affected",
"version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
"versionType": "git"
},
{
"lessThan": "aaef73821a3b0194a01bd23ca77774f704a04d40",
"status": "affected",
"version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
"versionType": "git"
},
{
"status": "affected",
"version": "66e12f5b3a9733f941893a00753b10498724607d",
"versionType": "git"
},
{
"lessThan": "5.4.275",
"status": "affected",
"version": "5.4.226",
"versionType": "semver"
},
{
"lessThan": "5.10.216",
"status": "affected",
"version": "5.10.157",
"versionType": "semver"
},
{
"lessThan": "5.15.157",
"status": "affected",
"version": "5.15.17",
"versionType": "semver"
},
{
"lessThan": "5.17",
"status": "affected",
"version": "5.16.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/android/binder.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.275",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.29",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.8.*",
"status": "unaffected",
"version": "6.8.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.9",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.275",
"versionStartIncluding": "5.4.226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.216",
"versionStartIncluding": "5.10.157",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.157",
"versionStartIncluding": "5.15.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.88",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.29",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8.8",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.16.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: check offset alignment in binder_get_object()\n\nCommit 6d98eb95b450 (\"binder: avoid potential data leakage when copying\ntxn\") introduced changes to how binder objects are copied. In doing so,\nit unintentionally removed an offset alignment check done through calls\nto binder_alloc_copy_from_buffer() -\u003e check_buffer().\n\nThese calls were replaced in binder_get_object() with copy_from_user(),\nso now an explicit offset alignment check is needed here. This avoids\nlater complications when unwinding the objects gets harder.\n\nIt is worth noting this check existed prior to commit 7a67a39320df\n(\"binder: add function to copy binder object from buffer\"), likely\nremoved due to redundancy at the time."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached through `ioctl(BINDER_WRITE_READ)` with `BC_TRANSACTION` on `/dev/binder` or a binderfs device node, requiring local access to the system. There is no remote or adjacent-network path into `binder_transaction()`.\nAC:L - The attacker fully and deterministically controls the offsets array and the transaction payload, so supplying a misaligned offset triggers the flawed path on the first try with no race, timing, or memory-layout dependency.\nPR:L - Any unprivileged local process can drive this \u2014 on Android every installed app holds binder access by design, and on general-purpose kernels binderfs is `FS_USERNS_MOUNT` while `BINDER_SET_CONTEXT_MGR` carries no capability check, so an ordinary user can set up both sender and target inside `unshare -Urn`.\nUI:N - The attacker issues the malformed transaction entirely from its own process; no victim action, file open, or mount by another user is needed.\nS:U - The mismanaged state is binder driver data owned by the kernel, and impact remains within the kernel\u0027s own security authority rather than crossing a hypervisor, IOMMU, or sandbox boundary.\nC:H - Dropping the alignment guard lets an unprivileged process desynchronize binder\u0027s object accounting so that `binder_node`/`binder_ref` lifetimes are no longer correctly tracked by the driver\u0027s refcounting \u2014 the same protection that prevents stale-object access \u2014 and this class of binder bookkeeping flaw is the established route to kernel memory read primitives on Android.\nI:H - The attacker causes unauthorized, permanent modification of another process\u0027s binder reference table and of node reference counts, state the attacker has no right to alter, and the resulting lifetime-tracking inconsistency is memory-safety relevant and leveragable toward write primitives.\nA:H - Every malformed transaction leaks a `binder_node` plus a `binder_ref` that the unwind path can never reclaim, and the loop can be repeated without bound against a chosen victim process, driving unreclaimable kernel allocation to OOM on memory-constrained Android and embedded devices."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:28:24.537Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12"
},
{
"url": "https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc"
},
{
"url": "https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c"
},
{
"url": "https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76"
},
{
"url": "https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc"
},
{
"url": "https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15"
},
{
"url": "https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40"
}
],
"title": "binder: check offset alignment in binder_get_object()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-26926",
"datePublished": "2024-04-24T23:23:40.600Z",
"dateReserved": "2024-02-19T14:20:24.194Z",
"dateUpdated": "2026-08-05T11:28:24.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…