{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "68a28f551e46",
                "status": "affected",
                "version": "c056a6ba35e0",
                "versionType": "custom"
              },
              {
                "lessThan": "48a1f83ca9c6",
                "status": "affected",
                "version": "23e9d815fad8",
                "versionType": "custom"
              },
              {
                "lessThan": "a2fd6dbc98be",
                "status": "affected",
                "version": "7a9ad4aceb02",
                "versionType": "custom"
              },
              {
                "lessThan": "a6d2a8b211c8",
                "status": "affected",
                "version": "6d98eb95b450",
                "versionType": "custom"
              },
              {
                "lessThan": "1d7f1049035b",
                "status": "affected",
                "version": "6d98eb95b450",
                "versionType": "custom"
              },
              {
                "lessThan": "f01d66190457",
                "status": "affected",
                "version": "6d98eb95b450",
                "versionType": "custom"
              },
              {
                "lessThan": "aaef73821a3b",
                "status": "affected",
                "version": "6d98eb95b450",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.17"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26926",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-13T03:55:21.790532Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-13T14:39:55.884Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.552Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/android/binder.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "68a28f551e4690db2b27b3db716c7395f6fada12",
              "status": "affected",
              "version": "c056a6ba35e00ae943e377eb09abd77a6915b31a",
              "versionType": "git"
            },
            {
              "lessThan": "48a1f83ca9c68518b1a783c62e6a8223144fa9fc",
              "status": "affected",
              "version": "23e9d815fad84c1bee3742a8de4bd39510435362",
              "versionType": "git"
            },
            {
              "lessThan": "a2fd6dbc98be1105a1d8e9e31575da8873ef115c",
              "status": "affected",
              "version": "7a9ad4aceb0226b391c9d3b8e4ac2e7d438b6bde",
              "versionType": "git"
            },
            {
              "lessThan": "a6d2a8b211c874971ee4cf3ddd167408177f6e76",
              "status": "affected",
              "version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
              "versionType": "git"
            },
            {
              "lessThan": "1d7f1049035b2060342f11eff957cf567d810bdc",
              "status": "affected",
              "version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
              "versionType": "git"
            },
            {
              "lessThan": "f01d6619045704d78613b14e2e0420bfdb7f1c15",
              "status": "affected",
              "version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
              "versionType": "git"
            },
            {
              "lessThan": "aaef73821a3b0194a01bd23ca77774f704a04d40",
              "status": "affected",
              "version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "66e12f5b3a9733f941893a00753b10498724607d",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.275",
              "status": "affected",
              "version": "5.4.226",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.216",
              "status": "affected",
              "version": "5.10.157",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.157",
              "status": "affected",
              "version": "5.15.17",
              "versionType": "semver"
            },
            {
              "lessThan": "5.17",
              "status": "affected",
              "version": "5.16.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/android/binder.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.275",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.275",
                  "versionStartIncluding": "5.4.226",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.216",
                  "versionStartIncluding": "5.10.157",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.157",
                  "versionStartIncluding": "5.15.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.88",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.29",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.8",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.16.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: check offset alignment in binder_get_object()\n\nCommit 6d98eb95b450 (\"binder: avoid potential data leakage when copying\ntxn\") introduced changes to how binder objects are copied. In doing so,\nit unintentionally removed an offset alignment check done through calls\nto binder_alloc_copy_from_buffer() -\u003e check_buffer().\n\nThese calls were replaced in binder_get_object() with copy_from_user(),\nso now an explicit offset alignment check is needed here. This avoids\nlater complications when unwinding the objects gets harder.\n\nIt is worth noting this check existed prior to commit 7a67a39320df\n(\"binder: add function to copy binder object from buffer\"), likely\nremoved due to redundancy at the time."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through `ioctl(BINDER_WRITE_READ)` with `BC_TRANSACTION` on `/dev/binder` or a binderfs device node, requiring local access to the system. There is no remote or adjacent-network path into `binder_transaction()`.\nAC:L - The attacker fully and deterministically controls the offsets array and the transaction payload, so supplying a misaligned offset triggers the flawed path on the first try with no race, timing, or memory-layout dependency.\nPR:L - Any unprivileged local process can drive this \u2014 on Android every installed app holds binder access by design, and on general-purpose kernels binderfs is `FS_USERNS_MOUNT` while `BINDER_SET_CONTEXT_MGR` carries no capability check, so an ordinary user can set up both sender and target inside `unshare -Urn`.\nUI:N - The attacker issues the malformed transaction entirely from its own process; no victim action, file open, or mount by another user is needed.\nS:U - The mismanaged state is binder driver data owned by the kernel, and impact remains within the kernel\u0027s own security authority rather than crossing a hypervisor, IOMMU, or sandbox boundary.\nC:H - Dropping the alignment guard lets an unprivileged process desynchronize binder\u0027s object accounting so that `binder_node`/`binder_ref` lifetimes are no longer correctly tracked by the driver\u0027s refcounting \u2014 the same protection that prevents stale-object access \u2014 and this class of binder bookkeeping flaw is the established route to kernel memory read primitives on Android.\nI:H - The attacker causes unauthorized, permanent modification of another process\u0027s binder reference table and of node reference counts, state the attacker has no right to alter, and the resulting lifetime-tracking inconsistency is memory-safety relevant and leveragable toward write primitives.\nA:H - Every malformed transaction leaks a `binder_node` plus a `binder_ref` that the unwind path can never reclaim, and the loop can be repeated without bound against a chosen victim process, driving unreclaimable kernel allocation to OOM on memory-constrained Android and embedded devices."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:28:24.537Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12"
        },
        {
          "url": "https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc"
        },
        {
          "url": "https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15"
        },
        {
          "url": "https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40"
        }
      ],
      "title": "binder: check offset alignment in binder_get_object()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26926",
    "datePublished": "2024-04-24T23:23:40.600Z",
    "dateReserved": "2024-02-19T14:20:24.194Z",
    "dateUpdated": "2026-08-05T11:28:24.537Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26926",
      "date": "2026-08-09",
      "epss": "0.0044",
      "percentile": "0.36205"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbinder: check offset alignment in binder_get_object()\\n\\nCommit 6d98eb95b450 (\\\"binder: avoid potential data leakage when copying\\ntxn\\\") introduced changes to how binder objects are copied. In doing so,\\nit unintentionally removed an offset alignment check done through calls\\nto binder_alloc_copy_from_buffer() -\u003e check_buffer().\\n\\nThese calls were replaced in binder_get_object() with copy_from_user(),\\nso now an explicit offset alignment check is needed here. This avoids\\nlater complications when unwinding the objects gets harder.\\n\\nIt is worth noting this check existed prior to commit 7a67a39320df\\n(\\\"binder: add function to copy binder object from buffer\\\"), likely\\nremoved due to redundancy at the time.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: Binder: verifique la alineaci\\u00f3n de desplazamiento en binder_get_object() El commit 6d98eb95b450 (\\\"binder: evite posibles fugas de datos al copiar txn\\\") introdujo cambios en la forma en que se copian los objetos de Binder. Al hacerlo, elimin\\u00f3 involuntariamente una verificaci\\u00f3n de alineaci\\u00f3n de desplazamiento realizada mediante llamadas a binder_alloc_copy_from_buffer() -\u0026gt; check_buffer(). Estas llamadas fueron reemplazadas en binder_get_object() con copy_from_user(), por lo que ahora se necesita aqu\\u00ed una verificaci\\u00f3n expl\\u00edcita de alineaci\\u00f3n de desplazamiento. Esto evita complicaciones posteriores cuando el desenrollado de los objetos se vuelve m\\u00e1s dif\\u00edcil. Vale la pena se\\u00f1alar que esta verificaci\\u00f3n exist\\u00eda antes de el commit 7a67a39320df (\\\"carpeta: agregar funci\\u00f3n para copiar el objeto de carpeta del b\\u00fafer\\\"), probablemente eliminada debido a la redundancia en ese momento.\"}]",
      "id": "CVE-2024-26926",
      "lastModified": "2024-11-21T09:03:24.013",
      "published": "2024-04-25T06:15:57.780",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26926\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-25T06:15:57.780\",\"lastModified\":\"2026-08-04T11:17:22.813\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbinder: check offset alignment in binder_get_object()\\n\\nCommit 6d98eb95b450 (\\\"binder: avoid potential data leakage when copying\\ntxn\\\") introduced changes to how binder objects are copied. In doing so,\\nit unintentionally removed an offset alignment check done through calls\\nto binder_alloc_copy_from_buffer() -\u003e check_buffer().\\n\\nThese calls were replaced in binder_get_object() with copy_from_user(),\\nso now an explicit offset alignment check is needed here. This avoids\\nlater complications when unwinding the objects gets harder.\\n\\nIt is worth noting this check existed prior to commit 7a67a39320df\\n(\\\"binder: add function to copy binder object from buffer\\\"), likely\\nremoved due to redundancy at the time.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: Binder: verifique la alineaci\u00f3n de desplazamiento en binder_get_object() El commit 6d98eb95b450 (\\\"binder: evite posibles fugas de datos al copiar txn\\\") introdujo cambios en la forma en que se copian los objetos de Binder. Al hacerlo, elimin\u00f3 involuntariamente una verificaci\u00f3n de alineaci\u00f3n de desplazamiento realizada mediante llamadas a binder_alloc_copy_from_buffer() -\u0026gt; check_buffer(). Estas llamadas fueron reemplazadas en binder_get_object() con copy_from_user(), por lo que ahora se necesita aqu\u00ed una verificaci\u00f3n expl\u00edcita de alineaci\u00f3n de desplazamiento. Esto evita complicaciones posteriores cuando el desenrollado de los objetos se vuelve m\u00e1s dif\u00edcil. Vale la pena se\u00f1alar que esta verificaci\u00f3n exist\u00eda antes de el commit 7a67a39320df (\\\"carpeta: agregar funci\u00f3n para copiar el objeto de carpeta del b\u00fafer\\\"), probablemente eliminada debido a la redundancia en ese momento.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/android/binder.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c056a6ba35e00ae943e377eb09abd77a6915b31a\",\"lessThan\":\"68a28f551e4690db2b27b3db716c7395f6fada12\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"23e9d815fad84c1bee3742a8de4bd39510435362\",\"lessThan\":\"48a1f83ca9c68518b1a783c62e6a8223144fa9fc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7a9ad4aceb0226b391c9d3b8e4ac2e7d438b6bde\",\"lessThan\":\"a2fd6dbc98be1105a1d8e9e31575da8873ef115c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6d98eb95b450a75adb4516a1d33652dc78d2b20c\",\"lessThan\":\"a6d2a8b211c874971ee4cf3ddd167408177f6e76\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6d98eb95b450a75adb4516a1d33652dc78d2b20c\",\"lessThan\":\"1d7f1049035b2060342f11eff957cf567d810bdc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6d98eb95b450a75adb4516a1d33652dc78d2b20c\",\"lessThan\":\"f01d6619045704d78613b14e2e0420bfdb7f1c15\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6d98eb95b450a75adb4516a1d33652dc78d2b20c\",\"lessThan\":\"aaef73821a3b0194a01bd23ca77774f704a04d40\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"66e12f5b3a9733f941893a00753b10498724607d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.4.226\",\"lessThan\":\"5.4.275\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.157\",\"lessThan\":\"5.10.216\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.17\",\"lessThan\":\"5.15.157\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.16.3\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/android/binder.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.275\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.216\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.157\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.88\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.29\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.8\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"c056a6ba35e0\",\"lessThan\":\"68a28f551e46\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"23e9d815fad8\",\"lessThan\":\"48a1f83ca9c6\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"7a9ad4aceb02\",\"lessThan\":\"a2fd6dbc98be\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"6d98eb95b450\",\"lessThan\":\"a6d2a8b211c8\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"6d98eb95b450\",\"lessThan\":\"1d7f1049035b\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"6d98eb95b450\",\"lessThan\":\"f01d66190457\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"6d98eb95b450\",\"lessThan\":\"aaef73821a3b\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-13T03:55:21.790532Z\",\"id\":\"CVE-2024-26926\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.226\",\"versionEndExcluding\":\"5.4.275\",\"matchCriteriaId\":\"2DC0F822-2537-459C-B6B4-AFB7BE1CF445\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.157\",\"versionEndExcluding\":\"5.10.216\",\"matchCriteriaId\":\"533F4A36-7FFD-4A1F-9AA0-4B5D2B41B7C1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.17\",\"versionEndExcluding\":\"5.15.157\",\"matchCriteriaId\":\"2C224AF6-4425-43A8-9DFD-DC3014EB487E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16.3\",\"versionEndExcluding\":\"6.1.88\",\"matchCriteriaId\":\"3E29B36A-C3F1-4464-8C44-1DD61018B22D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.29\",\"matchCriteriaId\":\"0999E154-1E68-41FA-8DE3-9A735E382224\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.8\",\"matchCriteriaId\":\"673B3328-389D-41A4-9617-669298635262\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A06B2CCF-3F43-4FA9-8773-C83C3F5764B2\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:48:51+00:00",
      "cve": "CVE-2024-26926",
      "id": "CVE-2024-26926",
      "initial_release_date": "2024-04-24T00:00:00+00:00",
      "product_status:known_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: binder: check offset alignment in binder_get_object()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26926.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T01:00:31Z",
      "cve": "CVE-2024-26926",
      "id": "CVE-2024-26926",
      "initial_release_date": "2024-04-25T23:11:53Z",
      "product_status:known_not_affected": "288",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26926",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26926.json",
      "version": "18"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:21:05.552Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26926\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-13T03:55:21.790532Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"c056a6ba35e0\", \"lessThan\": \"68a28f551e46\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"23e9d815fad8\", \"lessThan\": \"48a1f83ca9c6\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"7a9ad4aceb02\", \"lessThan\": \"a2fd6dbc98be\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6d98eb95b450\", \"lessThan\": \"a6d2a8b211c8\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6d98eb95b450\", \"lessThan\": \"1d7f1049035b\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6d98eb95b450\", \"lessThan\": \"f01d66190457\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6d98eb95b450\", \"lessThan\": \"aaef73821a3b\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.17\"}], \"defaultStatus\": \"affected\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-13T14:39:51.124Z\"}}], \"cna\": {\"title\": \"binder: check offset alignment in binder_get_object()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is reached through `ioctl(BINDER_WRITE_READ)` with `BC_TRANSACTION` on `/dev/binder` or a binderfs device node, requiring local access to the system. There is no remote or adjacent-network path into `binder_transaction()`.\\nAC:L - The attacker fully and deterministically controls the offsets array and the transaction payload, so supplying a misaligned offset triggers the flawed path on the first try with no race, timing, or memory-layout dependency.\\nPR:L - Any unprivileged local process can drive this \\u2014 on Android every installed app holds binder access by design, and on general-purpose kernels binderfs is `FS_USERNS_MOUNT` while `BINDER_SET_CONTEXT_MGR` carries no capability check, so an ordinary user can set up both sender and target inside `unshare -Urn`.\\nUI:N - The attacker issues the malformed transaction entirely from its own process; no victim action, file open, or mount by another user is needed.\\nS:U - The mismanaged state is binder driver data owned by the kernel, and impact remains within the kernel\u0027s own security authority rather than crossing a hypervisor, IOMMU, or sandbox boundary.\\nC:H - Dropping the alignment guard lets an unprivileged process desynchronize binder\u0027s object accounting so that `binder_node`/`binder_ref` lifetimes are no longer correctly tracked by the driver\u0027s refcounting \\u2014 the same protection that prevents stale-object access \\u2014 and this class of binder bookkeeping flaw is the established route to kernel memory read primitives on Android.\\nI:H - The attacker causes unauthorized, permanent modification of another process\u0027s binder reference table and of node reference counts, state the attacker has no right to alter, and the resulting lifetime-tracking inconsistency is memory-safety relevant and leveragable toward write primitives.\\nA:H - Every malformed transaction leaks a `binder_node` plus a `binder_ref` that the unwind path can never reclaim, and the loop can be repeated without bound against a chosen victim process, driving unreclaimable kernel allocation to OOM on memory-constrained Android and embedded devices.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c056a6ba35e00ae943e377eb09abd77a6915b31a\", \"lessThan\": \"68a28f551e4690db2b27b3db716c7395f6fada12\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"23e9d815fad84c1bee3742a8de4bd39510435362\", \"lessThan\": \"48a1f83ca9c68518b1a783c62e6a8223144fa9fc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7a9ad4aceb0226b391c9d3b8e4ac2e7d438b6bde\", \"lessThan\": \"a2fd6dbc98be1105a1d8e9e31575da8873ef115c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6d98eb95b450a75adb4516a1d33652dc78d2b20c\", \"lessThan\": \"a6d2a8b211c874971ee4cf3ddd167408177f6e76\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6d98eb95b450a75adb4516a1d33652dc78d2b20c\", \"lessThan\": \"1d7f1049035b2060342f11eff957cf567d810bdc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6d98eb95b450a75adb4516a1d33652dc78d2b20c\", \"lessThan\": \"f01d6619045704d78613b14e2e0420bfdb7f1c15\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6d98eb95b450a75adb4516a1d33652dc78d2b20c\", \"lessThan\": \"aaef73821a3b0194a01bd23ca77774f704a04d40\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"66e12f5b3a9733f941893a00753b10498724607d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.4.226\", \"lessThan\": \"5.4.275\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.10.157\", \"lessThan\": \"5.10.216\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.15.17\", \"lessThan\": \"5.15.157\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.16.3\", \"lessThan\": \"5.17\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/android/binder.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.17\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.17\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.275\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.216\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.157\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.88\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.29\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/android/binder.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12\"}, {\"url\": \"https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc\"}, {\"url\": \"https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c\"}, {\"url\": \"https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76\"}, {\"url\": \"https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc\"}, {\"url\": \"https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15\"}, {\"url\": \"https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbinder: check offset alignment in binder_get_object()\\n\\nCommit 6d98eb95b450 (\\\"binder: avoid potential data leakage when copying\\ntxn\\\") introduced changes to how binder objects are copied. In doing so,\\nit unintentionally removed an offset alignment check done through calls\\nto binder_alloc_copy_from_buffer() -\u003e check_buffer().\\n\\nThese calls were replaced in binder_get_object() with copy_from_user(),\\nso now an explicit offset alignment check is needed here. This avoids\\nlater complications when unwinding the objects gets harder.\\n\\nIt is worth noting this check existed prior to commit 7a67a39320df\\n(\\\"binder: add function to copy binder object from buffer\\\"), likely\\nremoved due to redundancy at the time.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.275\", \"versionStartIncluding\": \"5.4.226\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.216\", \"versionStartIncluding\": \"5.10.157\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.157\", \"versionStartIncluding\": \"5.15.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.88\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.29\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.8\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.16.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:28:24.537Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26926\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:28:24.537Z\", \"dateReserved\": \"2024-02-19T14:20:24.194Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-24T23:23:40.600Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}