GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-26983 (GCVE-0-2024-26983)

Vulnerability from cvelistv5 – Published: 2024-05-01 05:27 – Updated: 2026-08-05 11:28
VLAI
Title
bootconfig: use memblock_free_late to free xbc memory to buddy
Summary
In the Linux kernel, the following vulnerability has been resolved: bootconfig: use memblock_free_late to free xbc memory to buddy On the time to free xbc memory in xbc_exit(), memblock may has handed over memory to buddy allocator. So it doesn't make sense to free memory back to memblock. memblock_free() called by xbc_exit() even causes UAF bugs on architectures with CONFIG_ARCH_KEEP_MEMBLOCK disabled like x86. Following KASAN logs shows this case. This patch fixes the xbc memory free problem by calling memblock_free() in early xbc init error rewind path and calling memblock_free_late() in xbc exit path to free memory to buddy allocator. [ 9.410890] ================================================================== [ 9.418962] BUG: KASAN: use-after-free in memblock_isolate_range+0x12d/0x260 [ 9.426850] Read of size 8 at addr ffff88845dd30000 by task swapper/0/1 [ 9.435901] CPU: 9 PID: 1 Comm: swapper/0 Tainted: G U 6.9.0-rc3-00208-g586b5dfb51b9 #5 [ 9.446403] Hardware name: Intel Corporation RPLP LP5 (CPU:RaptorLake)/RPLP LP5 (ID:13), BIOS IRPPN02.01.01.00.00.19.015.D-00000000 Dec 28 2023 [ 9.460789] Call Trace: [ 9.463518] <TASK> [ 9.465859] dump_stack_lvl+0x53/0x70 [ 9.469949] print_report+0xce/0x610 [ 9.473944] ? __virt_addr_valid+0xf5/0x1b0 [ 9.478619] ? memblock_isolate_range+0x12d/0x260 [ 9.483877] kasan_report+0xc6/0x100 [ 9.487870] ? memblock_isolate_range+0x12d/0x260 [ 9.493125] memblock_isolate_range+0x12d/0x260 [ 9.498187] memblock_phys_free+0xb4/0x160 [ 9.502762] ? __pfx_memblock_phys_free+0x10/0x10 [ 9.508021] ? mutex_unlock+0x7e/0xd0 [ 9.512111] ? __pfx_mutex_unlock+0x10/0x10 [ 9.516786] ? kernel_init_freeable+0x2d4/0x430 [ 9.521850] ? __pfx_kernel_init+0x10/0x10 [ 9.526426] xbc_exit+0x17/0x70 [ 9.529935] kernel_init+0x38/0x1e0 [ 9.533829] ? _raw_spin_unlock_irq+0xd/0x30 [ 9.538601] ret_from_fork+0x2c/0x50 [ 9.542596] ? __pfx_kernel_init+0x10/0x10 [ 9.547170] ret_from_fork_asm+0x1a/0x30 [ 9.551552] </TASK> [ 9.555649] The buggy address belongs to the physical page: [ 9.561875] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x45dd30 [ 9.570821] flags: 0x200000000000000(node=0|zone=2) [ 9.576271] page_type: 0xffffffff() [ 9.580167] raw: 0200000000000000 ffffea0011774c48 ffffea0012ba1848 0000000000000000 [ 9.588823] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 9.597476] page dumped because: kasan: bad access detected [ 9.605362] Memory state around the buggy address: [ 9.610714] ffff88845dd2ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 9.618786] ffff88845dd2ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 9.626857] >ffff88845dd30000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.634930] ^ [ 9.638534] ffff88845dd30080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.646605] ffff88845dd30100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.654675] ==================================================================
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:45 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 40caa127f3c7279c75cb0c9684559fa314ee3a66 , < 1e7feb31a18c197d63a5e606025ed63c762f8918 (git)
Affected: 40caa127f3c7279c75cb0c9684559fa314ee3a66 , < e46d3be714ad9652480c6db129ab8125e2d20ab7 (git)
Affected: 40caa127f3c7279c75cb0c9684559fa314ee3a66 , < 5a7dfb8fcd3f29fc93161100179b27f24f3d5f35 (git)
Affected: 40caa127f3c7279c75cb0c9684559fa314ee3a66 , < 89f9a1e876b5a7ad884918c03a46831af202c8a0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.1.88 , ≤ 6.1.* (semver)
Unaffected: 6.6.29 , ≤ 6.6.* (semver)
Unaffected: 6.8.8 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:15:06.403Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1e7feb31a18c197d63a5e606025ed63c762f8918"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e46d3be714ad9652480c6db129ab8125e2d20ab7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5a7dfb8fcd3f29fc93161100179b27f24f3d5f35"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/89f9a1e876b5a7ad884918c03a46831af202c8a0"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26983",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:45:03.466509Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:42.750Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bootconfig.h",
            "lib/bootconfig.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1e7feb31a18c197d63a5e606025ed63c762f8918",
              "status": "affected",
              "version": "40caa127f3c7279c75cb0c9684559fa314ee3a66",
              "versionType": "git"
            },
            {
              "lessThan": "e46d3be714ad9652480c6db129ab8125e2d20ab7",
              "status": "affected",
              "version": "40caa127f3c7279c75cb0c9684559fa314ee3a66",
              "versionType": "git"
            },
            {
              "lessThan": "5a7dfb8fcd3f29fc93161100179b27f24f3d5f35",
              "status": "affected",
              "version": "40caa127f3c7279c75cb0c9684559fa314ee3a66",
              "versionType": "git"
            },
            {
              "lessThan": "89f9a1e876b5a7ad884918c03a46831af202c8a0",
              "status": "affected",
              "version": "40caa127f3c7279c75cb0c9684559fa314ee3a66",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bootconfig.h",
            "lib/bootconfig.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.88",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.29",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.8",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbootconfig: use memblock_free_late to free xbc memory to buddy\n\nOn the time to free xbc memory in xbc_exit(), memblock may has handed\nover memory to buddy allocator. So it doesn\u0027t make sense to free memory\nback to memblock. memblock_free() called by xbc_exit() even causes UAF bugs\non architectures with CONFIG_ARCH_KEEP_MEMBLOCK disabled like x86.\nFollowing KASAN logs shows this case.\n\nThis patch fixes the xbc memory free problem by calling memblock_free()\nin early xbc init error rewind path and calling memblock_free_late() in\nxbc exit path to free memory to buddy allocator.\n\n[    9.410890] ==================================================================\n[    9.418962] BUG: KASAN: use-after-free in memblock_isolate_range+0x12d/0x260\n[    9.426850] Read of size 8 at addr ffff88845dd30000 by task swapper/0/1\n\n[    9.435901] CPU: 9 PID: 1 Comm: swapper/0 Tainted: G     U             6.9.0-rc3-00208-g586b5dfb51b9 #5\n[    9.446403] Hardware name: Intel Corporation RPLP LP5 (CPU:RaptorLake)/RPLP LP5 (ID:13), BIOS IRPPN02.01.01.00.00.19.015.D-00000000 Dec 28 2023\n[    9.460789] Call Trace:\n[    9.463518]  \u003cTASK\u003e\n[    9.465859]  dump_stack_lvl+0x53/0x70\n[    9.469949]  print_report+0xce/0x610\n[    9.473944]  ? __virt_addr_valid+0xf5/0x1b0\n[    9.478619]  ? memblock_isolate_range+0x12d/0x260\n[    9.483877]  kasan_report+0xc6/0x100\n[    9.487870]  ? memblock_isolate_range+0x12d/0x260\n[    9.493125]  memblock_isolate_range+0x12d/0x260\n[    9.498187]  memblock_phys_free+0xb4/0x160\n[    9.502762]  ? __pfx_memblock_phys_free+0x10/0x10\n[    9.508021]  ? mutex_unlock+0x7e/0xd0\n[    9.512111]  ? __pfx_mutex_unlock+0x10/0x10\n[    9.516786]  ? kernel_init_freeable+0x2d4/0x430\n[    9.521850]  ? __pfx_kernel_init+0x10/0x10\n[    9.526426]  xbc_exit+0x17/0x70\n[    9.529935]  kernel_init+0x38/0x1e0\n[    9.533829]  ? _raw_spin_unlock_irq+0xd/0x30\n[    9.538601]  ret_from_fork+0x2c/0x50\n[    9.542596]  ? __pfx_kernel_init+0x10/0x10\n[    9.547170]  ret_from_fork_asm+0x1a/0x30\n[    9.551552]  \u003c/TASK\u003e\n\n[    9.555649] The buggy address belongs to the physical page:\n[    9.561875] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x45dd30\n[    9.570821] flags: 0x200000000000000(node=0|zone=2)\n[    9.576271] page_type: 0xffffffff()\n[    9.580167] raw: 0200000000000000 ffffea0011774c48 ffffea0012ba1848 0000000000000000\n[    9.588823] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000\n[    9.597476] page dumped because: kasan: bad access detected\n\n[    9.605362] Memory state around the buggy address:\n[    9.610714]  ffff88845dd2ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[    9.618786]  ffff88845dd2ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[    9.626857] \u003effff88845dd30000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n[    9.634930]                    ^\n[    9.638534]  ffff88845dd30080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n[    9.646605]  ffff88845dd30100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n[    9.654675] =================================================================="
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The defect lives in `__init` boot path code (`kernel_init()` \u2192 `exit_boot_config()` \u2192 `xbc_exit()`) and in memblock teardown; there is no network, adjacent-network, or remote-peer data path of any kind, and reaching it requires being present on the local machine as it boots. Local is the highest defensible vector for boot-time-only code.\nAC:L - Once `CONFIG_BOOT_CONFIG` is enabled (Kconfig recommends \"say Y\") and a bootconfig is supplied via initrd/cmdline, embedded blob, or `BOOT_CONFIG_FORCE`, the use-after-free occurs on every boot with no race, timing window, or memory-layout condition to win \u2014 x86\u0027s default `!CONFIG_ARCH_KEEP_MEMBLOCK` guarantees `memblock_discard()` has already released `memblock.reserved.regions` to buddy before `kernel_init()` runs.\nPR:L - There is no runtime privilege gate on this path at all because it executes in the `kernel_init` thread before any userspace process exists; PR:L is selected as the higher-severity of the plausible local options rather than PR:H, even though arranging the bootconfig itself would require bootloader/initrd control.\nUI:N - No victim action such as mounting a filesystem, opening a device, or plugging in hardware is involved \u2014 `exit_boot_config()` is invoked unconditionally by the kernel itself in `kernel_init()`.\nS:U - Both the faulting code and the corrupted memory are kernel-owned; no VM, IOMMU, hypervisor, or sandbox boundary is crossed.\nC:H - This is a confirmed use-after-free (KASAN \"Read of size 8\" in `memblock_isolate_range`) against pages already handed to the buddy allocator and reallocated to arbitrary kernel consumers; the freed contents are consumed as region bounds that steer subsequent writes, and corrupting a reallocated page-table or slab page during boot is a plausible route to kernel memory disclosure.\nI:H - The path does not merely read freed memory \u2014 `memblock_isolate_range()` writes `rgn-\u003ebase`/`rgn-\u003esize`, `memblock_insert_region()` and `memblock_remove_region()` `memmove()` region structs, and the empty-array case zeroes `regions[0]`, all into buddy-owned pages that other kernel subsystems are actively using, silently corrupting live kernel state with values derived from the bootconfig allocations\u0027 physical geometry.\nA:H - Writing memblock region structures over reallocated live kernel memory during boot produces oopses/panics \u2014 KASAN reports it immediately, and without KASAN the corrupted page tables, slab objects, or task structures cause crash-class failures that can render the system unbootable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:28:50.558Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1e7feb31a18c197d63a5e606025ed63c762f8918"
        },
        {
          "url": "https://git.kernel.org/stable/c/e46d3be714ad9652480c6db129ab8125e2d20ab7"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a7dfb8fcd3f29fc93161100179b27f24f3d5f35"
        },
        {
          "url": "https://git.kernel.org/stable/c/89f9a1e876b5a7ad884918c03a46831af202c8a0"
        }
      ],
      "title": "bootconfig: use memblock_free_late to free xbc memory to buddy",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26983",
    "datePublished": "2024-05-01T05:27:15.635Z",
    "dateReserved": "2024-02-19T14:20:24.204Z",
    "dateUpdated": "2026-08-05T11:28:50.558Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26983",
      "date": "2026-09-16",
      "epss": "0.00232",
      "percentile": "0.14272"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.15\", \"versionEndExcluding\": \"6.1.88\", \"matchCriteriaId\": \"E83B1A9F-AE82-4AE9-98A3-62E2A8D4FD46\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.29\", \"matchCriteriaId\": \"0999E154-1E68-41FA-8DE3-9A735E382224\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.8.8\", \"matchCriteriaId\": \"673B3328-389D-41A4-9617-669298635262\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"A06B2CCF-3F43-4FA9-8773-C83C3F5764B2\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbootconfig: use memblock_free_late to free xbc memory to buddy\\n\\nOn the time to free xbc memory in xbc_exit(), memblock may has handed\\nover memory to buddy allocator. So it doesn\u0027t make sense to free memory\\nback to memblock. memblock_free() called by xbc_exit() even causes UAF bugs\\non architectures with CONFIG_ARCH_KEEP_MEMBLOCK disabled like x86.\\nFollowing KASAN logs shows this case.\\n\\nThis patch fixes the xbc memory free problem by calling memblock_free()\\nin early xbc init error rewind path and calling memblock_free_late() in\\nxbc exit path to free memory to buddy allocator.\\n\\n[    9.410890] ==================================================================\\n[    9.418962] BUG: KASAN: use-after-free in memblock_isolate_range+0x12d/0x260\\n[    9.426850] Read of size 8 at addr ffff88845dd30000 by task swapper/0/1\\n\\n[    9.435901] CPU: 9 PID: 1 Comm: swapper/0 Tainted: G     U             6.9.0-rc3-00208-g586b5dfb51b9 #5\\n[    9.446403] Hardware name: Intel Corporation RPLP LP5 (CPU:RaptorLake)/RPLP LP5 (ID:13), BIOS IRPPN02.01.01.00.00.19.015.D-00000000 Dec 28 2023\\n[    9.460789] Call Trace:\\n[    9.463518]  \u003cTASK\u003e\\n[    9.465859]  dump_stack_lvl+0x53/0x70\\n[    9.469949]  print_report+0xce/0x610\\n[    9.473944]  ? __virt_addr_valid+0xf5/0x1b0\\n[    9.478619]  ? memblock_isolate_range+0x12d/0x260\\n[    9.483877]  kasan_report+0xc6/0x100\\n[    9.487870]  ? memblock_isolate_range+0x12d/0x260\\n[    9.493125]  memblock_isolate_range+0x12d/0x260\\n[    9.498187]  memblock_phys_free+0xb4/0x160\\n[    9.502762]  ? __pfx_memblock_phys_free+0x10/0x10\\n[    9.508021]  ? mutex_unlock+0x7e/0xd0\\n[    9.512111]  ? __pfx_mutex_unlock+0x10/0x10\\n[    9.516786]  ? kernel_init_freeable+0x2d4/0x430\\n[    9.521850]  ? __pfx_kernel_init+0x10/0x10\\n[    9.526426]  xbc_exit+0x17/0x70\\n[    9.529935]  kernel_init+0x38/0x1e0\\n[    9.533829]  ? _raw_spin_unlock_irq+0xd/0x30\\n[    9.538601]  ret_from_fork+0x2c/0x50\\n[    9.542596]  ? __pfx_kernel_init+0x10/0x10\\n[    9.547170]  ret_from_fork_asm+0x1a/0x30\\n[    9.551552]  \u003c/TASK\u003e\\n\\n[    9.555649] The buggy address belongs to the physical page:\\n[    9.561875] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x45dd30\\n[    9.570821] flags: 0x200000000000000(node=0|zone=2)\\n[    9.576271] page_type: 0xffffffff()\\n[    9.580167] raw: 0200000000000000 ffffea0011774c48 ffffea0012ba1848 0000000000000000\\n[    9.588823] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000\\n[    9.597476] page dumped because: kasan: bad access detected\\n\\n[    9.605362] Memory state around the buggy address:\\n[    9.610714]  ffff88845dd2ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\\n[    9.618786]  ffff88845dd2ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\\n[    9.626857] \u003effff88845dd30000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\\n[    9.634930]                    ^\\n[    9.638534]  ffff88845dd30080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\\n[    9.646605]  ffff88845dd30100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\\n[    9.654675] ==================================================================\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: bootconfig: use memblock_free_late para liberar memoria xbc para el amigo En el momento de liberar memoria xbc en xbc_exit(), es posible que memblock haya entregado la memoria al asignador de amigos. Por lo tanto, no tiene sentido liberar memoria en Memblock. memblock_free() llamado por xbc_exit() incluso causa errores UAF en arquitecturas con CONFIG_ARCH_KEEP_MEMBLOCK deshabilitado como x86. Los siguientes registros de KASAN muestran este caso. Este parche soluciona el problema de falta de memoria de xbc llamando a memblock_free() en la ruta de rebobinado del error de inicio temprano de xbc y llamando a memblock_free_late() en la ruta de salida de xbc para liberar memoria al asignador de amigos. [9.410890] ================================================= =================== [9.418962] ERROR: KASAN: use-after-free en memblock_isolate_range+0x12d/0x260 [9.426850] Lectura de tama\\u00f1o 8 en la direcci\\u00f3n ffff88845dd30000 por el intercambiador de tareas /0/1 [ 9.435901] CPU: 9 PID: 1 Comm: swapper/0 Contaminado: GU 6.9.0-rc3-00208-g586b5dfb51b9 #5 [ 9.446403] Nombre de hardware: Intel Corporation RPLP LP5 (CPU:RaptorLake)/RPLP LP5 (ID:13), BIOS IRPPN02.01.01.00.00.19.015.D-00000000 28 de diciembre de 2023 [9.460789] Seguimiento de llamadas: [9.463518]  [9.465859] dump_stack_lvl+0x53/0x70 [9.469949] puerto+0xce/0x610 [ 9.473944] ? __virt_addr_valid+0xf5/0x1b0 [9.478619]? memblock_isolate_range+0x12d/0x260 [ 9.483877] kasan_report+0xc6/0x100 [ 9.487870] ? memblock_isolate_range+0x12d/0x260 [9.493125] memblock_isolate_range+0x12d/0x260 [9.498187] memblock_phys_free+0xb4/0x160 [9.502762]? __pfx_memblock_phys_free+0x10/0x10 [9.508021]? mutex_unlock+0x7e/0xd0 [9.512111]? __pfx_mutex_unlock+0x10/0x10 [9.516786]? kernel_init_freeable+0x2d4/0x430 [9.521850]? __pfx_kernel_init+0x10/0x10 [ 9.526426] xbc_exit+0x17/0x70 [ 9.529935] kernel_init+0x38/0x1e0 [ 9.533829] ? _raw_spin_unlock_irq+0xd/0x30 [9.538601] ret_from_fork+0x2c/0x50 [9.542596]? __pfx_kernel_init+0x10/0x10 [ 9.547170] ret_from_fork_asm+0x1a/0x30 [ 9.551552]  [ 9.555649] La direcci\\u00f3n con errores pertenece a la p\\u00e1gina f\\u00edsica: [ 9.561875] p\\u00e1gina: refcount:0 mapcount:0 mapeo:00000000000 \\u00cdndice 00000: 0x1 pfn :0x45dd30 [ 9.570821] banderas: 0x200000000000000(nodo=0|zona=2) [ 9.576271] tipo de p\\u00e1gina: 0xffffffff() [ 9.580167] raw: 0200000000000000 ffffea0011774c48 12ba1848 0000000000000000 [9.588823] raw: 0000000000000001 0000000000000000 00000000ffffffff 000000000000000000000000 [9.597476] p\\u00e1gina volcada porque: kasan: mal acceso detectado [9.605362] Estado de la memoria alrededor de la direcci\\u00f3n con errores: [9.610714] ffff88845dd2ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 9.618786] ffff88845dd2ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 9.626857] \u0026gt;ffff88845dd30000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.634930] ^ [ 9.638534] ffff88845dd30080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.646605] ffff88845dd30100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.654675] ======================= ===============================================\"}]",
      "id": "CVE-2024-26983",
      "lastModified": "2024-12-23T14:53:02.043",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-05-01T06:15:15.747",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/1e7feb31a18c197d63a5e606025ed63c762f8918\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5a7dfb8fcd3f29fc93161100179b27f24f3d5f35\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/89f9a1e876b5a7ad884918c03a46831af202c8a0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e46d3be714ad9652480c6db129ab8125e2d20ab7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/1e7feb31a18c197d63a5e606025ed63c762f8918\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5a7dfb8fcd3f29fc93161100179b27f24f3d5f35\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/89f9a1e876b5a7ad884918c03a46831af202c8a0\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e46d3be714ad9652480c6db129ab8125e2d20ab7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T14:56:13.000Z",
      "cve": "CVE-2024-26983",
      "id": "msrc_CVE-2024-26983",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "5",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bootconfig: use memblock_free_late to free xbc memory to buddy",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-26983.json",
      "version": "15"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26983\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-01T06:15:15.747\",\"lastModified\":\"2026-08-04T11:17:30.837\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbootconfig: use memblock_free_late to free xbc memory to buddy\\n\\nOn the time to free xbc memory in xbc_exit(), memblock may has handed\\nover memory to buddy allocator. So it doesn\u0027t make sense to free memory\\nback to memblock. memblock_free() called by xbc_exit() even causes UAF bugs\\non architectures with CONFIG_ARCH_KEEP_MEMBLOCK disabled like x86.\\nFollowing KASAN logs shows this case.\\n\\nThis patch fixes the xbc memory free problem by calling memblock_free()\\nin early xbc init error rewind path and calling memblock_free_late() in\\nxbc exit path to free memory to buddy allocator.\\n\\n[    9.410890] ==================================================================\\n[    9.418962] BUG: KASAN: use-after-free in memblock_isolate_range+0x12d/0x260\\n[    9.426850] Read of size 8 at addr ffff88845dd30000 by task swapper/0/1\\n\\n[    9.435901] CPU: 9 PID: 1 Comm: swapper/0 Tainted: G     U             6.9.0-rc3-00208-g586b5dfb51b9 #5\\n[    9.446403] Hardware name: Intel Corporation RPLP LP5 (CPU:RaptorLake)/RPLP LP5 (ID:13), BIOS IRPPN02.01.01.00.00.19.015.D-00000000 Dec 28 2023\\n[    9.460789] Call Trace:\\n[    9.463518]  \u003cTASK\u003e\\n[    9.465859]  dump_stack_lvl+0x53/0x70\\n[    9.469949]  print_report+0xce/0x610\\n[    9.473944]  ? __virt_addr_valid+0xf5/0x1b0\\n[    9.478619]  ? memblock_isolate_range+0x12d/0x260\\n[    9.483877]  kasan_report+0xc6/0x100\\n[    9.487870]  ? memblock_isolate_range+0x12d/0x260\\n[    9.493125]  memblock_isolate_range+0x12d/0x260\\n[    9.498187]  memblock_phys_free+0xb4/0x160\\n[    9.502762]  ? __pfx_memblock_phys_free+0x10/0x10\\n[    9.508021]  ? mutex_unlock+0x7e/0xd0\\n[    9.512111]  ? __pfx_mutex_unlock+0x10/0x10\\n[    9.516786]  ? kernel_init_freeable+0x2d4/0x430\\n[    9.521850]  ? __pfx_kernel_init+0x10/0x10\\n[    9.526426]  xbc_exit+0x17/0x70\\n[    9.529935]  kernel_init+0x38/0x1e0\\n[    9.533829]  ? _raw_spin_unlock_irq+0xd/0x30\\n[    9.538601]  ret_from_fork+0x2c/0x50\\n[    9.542596]  ? __pfx_kernel_init+0x10/0x10\\n[    9.547170]  ret_from_fork_asm+0x1a/0x30\\n[    9.551552]  \u003c/TASK\u003e\\n\\n[    9.555649] The buggy address belongs to the physical page:\\n[    9.561875] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x45dd30\\n[    9.570821] flags: 0x200000000000000(node=0|zone=2)\\n[    9.576271] page_type: 0xffffffff()\\n[    9.580167] raw: 0200000000000000 ffffea0011774c48 ffffea0012ba1848 0000000000000000\\n[    9.588823] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000\\n[    9.597476] page dumped because: kasan: bad access detected\\n\\n[    9.605362] Memory state around the buggy address:\\n[    9.610714]  ffff88845dd2ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\\n[    9.618786]  ffff88845dd2ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\\n[    9.626857] \u003effff88845dd30000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\\n[    9.634930]                    ^\\n[    9.638534]  ffff88845dd30080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\\n[    9.646605]  ffff88845dd30100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\\n[    9.654675] ==================================================================\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: bootconfig: use memblock_free_late para liberar memoria xbc para el amigo En el momento de liberar memoria xbc en xbc_exit(), es posible que memblock haya entregado la memoria al asignador de amigos. Por lo tanto, no tiene sentido liberar memoria en Memblock. memblock_free() llamado por xbc_exit() incluso causa errores UAF en arquitecturas con CONFIG_ARCH_KEEP_MEMBLOCK deshabilitado como x86. Los siguientes registros de KASAN muestran este caso. Este parche soluciona el problema de falta de memoria de xbc llamando a memblock_free() en la ruta de rebobinado del error de inicio temprano de xbc y llamando a memblock_free_late() en la ruta de salida de xbc para liberar memoria al asignador de amigos. [9.410890] ================================================= =================== [9.418962] ERROR: KASAN: use-after-free en memblock_isolate_range+0x12d/0x260 [9.426850] Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff88845dd30000 por el intercambiador de tareas /0/1 [ 9.435901] CPU: 9 PID: 1 Comm: swapper/0 Contaminado: GU 6.9.0-rc3-00208-g586b5dfb51b9 #5 [ 9.446403] Nombre de hardware: Intel Corporation RPLP LP5 (CPU:RaptorLake)/RPLP LP5 (ID:13), BIOS IRPPN02.01.01.00.00.19.015.D-00000000 28 de diciembre de 2023 [9.460789] Seguimiento de llamadas: [9.463518]  [9.465859] dump_stack_lvl+0x53/0x70 [9.469949] puerto+0xce/0x610 [ 9.473944] ? __virt_addr_valid+0xf5/0x1b0 [9.478619]? memblock_isolate_range+0x12d/0x260 [ 9.483877] kasan_report+0xc6/0x100 [ 9.487870] ? memblock_isolate_range+0x12d/0x260 [9.493125] memblock_isolate_range+0x12d/0x260 [9.498187] memblock_phys_free+0xb4/0x160 [9.502762]? __pfx_memblock_phys_free+0x10/0x10 [9.508021]? mutex_unlock+0x7e/0xd0 [9.512111]? __pfx_mutex_unlock+0x10/0x10 [9.516786]? kernel_init_freeable+0x2d4/0x430 [9.521850]? __pfx_kernel_init+0x10/0x10 [ 9.526426] xbc_exit+0x17/0x70 [ 9.529935] kernel_init+0x38/0x1e0 [ 9.533829] ? _raw_spin_unlock_irq+0xd/0x30 [9.538601] ret_from_fork+0x2c/0x50 [9.542596]? __pfx_kernel_init+0x10/0x10 [ 9.547170] ret_from_fork_asm+0x1a/0x30 [ 9.551552]  [ 9.555649] La direcci\u00f3n con errores pertenece a la p\u00e1gina f\u00edsica: [ 9.561875] p\u00e1gina: refcount:0 mapcount:0 mapeo:00000000000 \u00cdndice 00000: 0x1 pfn :0x45dd30 [ 9.570821] banderas: 0x200000000000000(nodo=0|zona=2) [ 9.576271] tipo de p\u00e1gina: 0xffffffff() [ 9.580167] raw: 0200000000000000 ffffea0011774c48 12ba1848 0000000000000000 [9.588823] raw: 0000000000000001 0000000000000000 00000000ffffffff 000000000000000000000000 [9.597476] p\u00e1gina volcada porque: kasan: mal acceso detectado [9.605362] Estado de la memoria alrededor de la direcci\u00f3n con errores: [9.610714] ffff88845dd2ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 9.618786] ffff88845dd2ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 9.626857] \u0026gt;ffff88845dd30000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.634930] ^ [ 9.638534] ffff88845dd30080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.646605] ffff88845dd30100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.654675] ======================= ===============================================\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/linux/bootconfig.h\",\"lib/bootconfig.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"40caa127f3c7279c75cb0c9684559fa314ee3a66\",\"lessThan\":\"1e7feb31a18c197d63a5e606025ed63c762f8918\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"40caa127f3c7279c75cb0c9684559fa314ee3a66\",\"lessThan\":\"e46d3be714ad9652480c6db129ab8125e2d20ab7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"40caa127f3c7279c75cb0c9684559fa314ee3a66\",\"lessThan\":\"5a7dfb8fcd3f29fc93161100179b27f24f3d5f35\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"40caa127f3c7279c75cb0c9684559fa314ee3a66\",\"lessThan\":\"89f9a1e876b5a7ad884918c03a46831af202c8a0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/linux/bootconfig.h\",\"lib/bootconfig.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.88\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.29\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.8\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T15:45:03.466509Z\",\"id\":\"CVE-2024-26983\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"6.1.88\",\"matchCriteriaId\":\"E83B1A9F-AE82-4AE9-98A3-62E2A8D4FD46\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.29\",\"matchCriteriaId\":\"0999E154-1E68-41FA-8DE3-9A735E382224\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.8\",\"matchCriteriaId\":\"673B3328-389D-41A4-9617-669298635262\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A06B2CCF-3F43-4FA9-8773-C83C3F5764B2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1e7feb31a18c197d63a5e606025ed63c762f8918\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5a7dfb8fcd3f29fc93161100179b27f24f3d5f35\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/89f9a1e876b5a7ad884918c03a46831af202c8a0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e46d3be714ad9652480c6db129ab8125e2d20ab7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1e7feb31a18c197d63a5e606025ed63c762f8918\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5a7dfb8fcd3f29fc93161100179b27f24f3d5f35\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/89f9a1e876b5a7ad884918c03a46831af202c8a0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e46d3be714ad9652480c6db129ab8125e2d20ab7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:48:34+00:00",
      "cve": "CVE-2024-26983",
      "id": "CVE-2024-26983",
      "initial_release_date": "2024-05-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bootconfig: use memblock_free_late to free xbc memory to buddy",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26983.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T01:12:32Z",
      "cve": "CVE-2024-26983",
      "id": "CVE-2024-26983",
      "initial_release_date": "2024-05-03T02:09:43Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "332",
      "product_status:recommended": "357",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26983",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26983.json",
      "version": "79"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/1e7feb31a18c197d63a5e606025ed63c762f8918\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e46d3be714ad9652480c6db129ab8125e2d20ab7\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5a7dfb8fcd3f29fc93161100179b27f24f3d5f35\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/89f9a1e876b5a7ad884918c03a46831af202c8a0\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T17:15:06.403Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26983\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:45:03.466509Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:18.291Z\"}}], \"cna\": {\"title\": \"bootconfig: use memblock_free_late to free xbc memory to buddy\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The defect lives in `__init` boot path code (`kernel_init()` \\u2192 `exit_boot_config()` \\u2192 `xbc_exit()`) and in memblock teardown; there is no network, adjacent-network, or remote-peer data path of any kind, and reaching it requires being present on the local machine as it boots. Local is the highest defensible vector for boot-time-only code.\\nAC:L - Once `CONFIG_BOOT_CONFIG` is enabled (Kconfig recommends \\\"say Y\\\") and a bootconfig is supplied via initrd/cmdline, embedded blob, or `BOOT_CONFIG_FORCE`, the use-after-free occurs on every boot with no race, timing window, or memory-layout condition to win \\u2014 x86\u0027s default `!CONFIG_ARCH_KEEP_MEMBLOCK` guarantees `memblock_discard()` has already released `memblock.reserved.regions` to buddy before `kernel_init()` runs.\\nPR:L - There is no runtime privilege gate on this path at all because it executes in the `kernel_init` thread before any userspace process exists; PR:L is selected as the higher-severity of the plausible local options rather than PR:H, even though arranging the bootconfig itself would require bootloader/initrd control.\\nUI:N - No victim action such as mounting a filesystem, opening a device, or plugging in hardware is involved \\u2014 `exit_boot_config()` is invoked unconditionally by the kernel itself in `kernel_init()`.\\nS:U - Both the faulting code and the corrupted memory are kernel-owned; no VM, IOMMU, hypervisor, or sandbox boundary is crossed.\\nC:H - This is a confirmed use-after-free (KASAN \\\"Read of size 8\\\" in `memblock_isolate_range`) against pages already handed to the buddy allocator and reallocated to arbitrary kernel consumers; the freed contents are consumed as region bounds that steer subsequent writes, and corrupting a reallocated page-table or slab page during boot is a plausible route to kernel memory disclosure.\\nI:H - The path does not merely read freed memory \\u2014 `memblock_isolate_range()` writes `rgn-\u003ebase`/`rgn-\u003esize`, `memblock_insert_region()` and `memblock_remove_region()` `memmove()` region structs, and the empty-array case zeroes `regions[0]`, all into buddy-owned pages that other kernel subsystems are actively using, silently corrupting live kernel state with values derived from the bootconfig allocations\u0027 physical geometry.\\nA:H - Writing memblock region structures over reallocated live kernel memory during boot produces oopses/panics \\u2014 KASAN reports it immediately, and without KASAN the corrupted page tables, slab objects, or task structures cause crash-class failures that can render the system unbootable.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"40caa127f3c7279c75cb0c9684559fa314ee3a66\", \"lessThan\": \"1e7feb31a18c197d63a5e606025ed63c762f8918\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"40caa127f3c7279c75cb0c9684559fa314ee3a66\", \"lessThan\": \"e46d3be714ad9652480c6db129ab8125e2d20ab7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"40caa127f3c7279c75cb0c9684559fa314ee3a66\", \"lessThan\": \"5a7dfb8fcd3f29fc93161100179b27f24f3d5f35\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"40caa127f3c7279c75cb0c9684559fa314ee3a66\", \"lessThan\": \"89f9a1e876b5a7ad884918c03a46831af202c8a0\", \"versionType\": \"git\"}], \"programFiles\": [\"include/linux/bootconfig.h\", \"lib/bootconfig.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.88\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.29\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/linux/bootconfig.h\", \"lib/bootconfig.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/1e7feb31a18c197d63a5e606025ed63c762f8918\"}, {\"url\": \"https://git.kernel.org/stable/c/e46d3be714ad9652480c6db129ab8125e2d20ab7\"}, {\"url\": \"https://git.kernel.org/stable/c/5a7dfb8fcd3f29fc93161100179b27f24f3d5f35\"}, {\"url\": \"https://git.kernel.org/stable/c/89f9a1e876b5a7ad884918c03a46831af202c8a0\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbootconfig: use memblock_free_late to free xbc memory to buddy\\n\\nOn the time to free xbc memory in xbc_exit(), memblock may has handed\\nover memory to buddy allocator. So it doesn\u0027t make sense to free memory\\nback to memblock. memblock_free() called by xbc_exit() even causes UAF bugs\\non architectures with CONFIG_ARCH_KEEP_MEMBLOCK disabled like x86.\\nFollowing KASAN logs shows this case.\\n\\nThis patch fixes the xbc memory free problem by calling memblock_free()\\nin early xbc init error rewind path and calling memblock_free_late() in\\nxbc exit path to free memory to buddy allocator.\\n\\n[    9.410890] ==================================================================\\n[    9.418962] BUG: KASAN: use-after-free in memblock_isolate_range+0x12d/0x260\\n[    9.426850] Read of size 8 at addr ffff88845dd30000 by task swapper/0/1\\n\\n[    9.435901] CPU: 9 PID: 1 Comm: swapper/0 Tainted: G     U             6.9.0-rc3-00208-g586b5dfb51b9 #5\\n[    9.446403] Hardware name: Intel Corporation RPLP LP5 (CPU:RaptorLake)/RPLP LP5 (ID:13), BIOS IRPPN02.01.01.00.00.19.015.D-00000000 Dec 28 2023\\n[    9.460789] Call Trace:\\n[    9.463518]  \u003cTASK\u003e\\n[    9.465859]  dump_stack_lvl+0x53/0x70\\n[    9.469949]  print_report+0xce/0x610\\n[    9.473944]  ? __virt_addr_valid+0xf5/0x1b0\\n[    9.478619]  ? memblock_isolate_range+0x12d/0x260\\n[    9.483877]  kasan_report+0xc6/0x100\\n[    9.487870]  ? memblock_isolate_range+0x12d/0x260\\n[    9.493125]  memblock_isolate_range+0x12d/0x260\\n[    9.498187]  memblock_phys_free+0xb4/0x160\\n[    9.502762]  ? __pfx_memblock_phys_free+0x10/0x10\\n[    9.508021]  ? mutex_unlock+0x7e/0xd0\\n[    9.512111]  ? __pfx_mutex_unlock+0x10/0x10\\n[    9.516786]  ? kernel_init_freeable+0x2d4/0x430\\n[    9.521850]  ? __pfx_kernel_init+0x10/0x10\\n[    9.526426]  xbc_exit+0x17/0x70\\n[    9.529935]  kernel_init+0x38/0x1e0\\n[    9.533829]  ? _raw_spin_unlock_irq+0xd/0x30\\n[    9.538601]  ret_from_fork+0x2c/0x50\\n[    9.542596]  ? __pfx_kernel_init+0x10/0x10\\n[    9.547170]  ret_from_fork_asm+0x1a/0x30\\n[    9.551552]  \u003c/TASK\u003e\\n\\n[    9.555649] The buggy address belongs to the physical page:\\n[    9.561875] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x45dd30\\n[    9.570821] flags: 0x200000000000000(node=0|zone=2)\\n[    9.576271] page_type: 0xffffffff()\\n[    9.580167] raw: 0200000000000000 ffffea0011774c48 ffffea0012ba1848 0000000000000000\\n[    9.588823] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000\\n[    9.597476] page dumped because: kasan: bad access detected\\n\\n[    9.605362] Memory state around the buggy address:\\n[    9.610714]  ffff88845dd2ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\\n[    9.618786]  ffff88845dd2ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\\n[    9.626857] \u003effff88845dd30000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\\n[    9.634930]                    ^\\n[    9.638534]  ffff88845dd30080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\\n[    9.646605]  ffff88845dd30100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\\n[    9.654675] ==================================================================\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.88\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.29\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.8\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"5.15\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:28:50.558Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26983\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:28:50.558Z\", \"dateReserved\": \"2024-02-19T14:20:24.204Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-01T05:27:15.635Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.