CVE-2024-26768 (GCVE-0-2024-26768)
Vulnerability from cvelistv5 – Published: 2024-04-03 17:00 – Updated: 2026-08-05 11:27
VLAI
EPSS
VEX
Title
LoongArch: Change acpi_core_pic[NR_CPUS] to acpi_core_pic[MAX_CORE_PIC]
Summary
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: Change acpi_core_pic[NR_CPUS] to acpi_core_pic[MAX_CORE_PIC]
With default config, the value of NR_CPUS is 64. When HW platform has
more then 64 cpus, system will crash on these platforms. MAX_CORE_PIC
is the maximum cpu number in MADT table (max physical number) which can
exceed the supported maximum cpu number (NR_CPUS, max logical number),
but kernel should not crash. Kernel should boot cpus with NR_CPUS, let
the remainder cpus stay in BIOS.
The potential crash reason is that the array acpi_core_pic[NR_CPUS] can
be overflowed when parsing MADT table, and it is obvious that CORE_PIC
should be corresponding to physical core rather than logical core, so it
is better to define the array as acpi_core_pic[MAX_CORE_PIC].
With the patch, system can boot up 64 vcpus with qemu parameter -smp 128,
otherwise system will crash with the following message.
[ 0.000000] CPU 0 Unable to handle kernel paging request at virtual address 0000420000004259, era == 90000000037a5f0c, ra == 90000000037a46ec
[ 0.000000] Oops[#1]:
[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.8.0-rc2+ #192
[ 0.000000] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022
[ 0.000000] pc 90000000037a5f0c ra 90000000037a46ec tp 9000000003c90000 sp 9000000003c93d60
[ 0.000000] a0 0000000000000019 a1 9000000003d93bc0 a2 0000000000000000 a3 9000000003c93bd8
[ 0.000000] a4 9000000003c93a74 a5 9000000083c93a67 a6 9000000003c938f0 a7 0000000000000005
[ 0.000000] t0 0000420000004201 t1 0000000000000000 t2 0000000000000001 t3 0000000000000001
[ 0.000000] t4 0000000000000003 t5 0000000000000000 t6 0000000000000030 t7 0000000000000063
[ 0.000000] t8 0000000000000014 u0 ffffffffffffffff s9 0000000000000000 s0 9000000003caee98
[ 0.000000] s1 90000000041b0480 s2 9000000003c93da0 s3 9000000003c93d98 s4 9000000003c93d90
[ 0.000000] s5 9000000003caa000 s6 000000000a7fd000 s7 000000000f556b60 s8 000000000e0a4330
[ 0.000000] ra: 90000000037a46ec platform_init+0x214/0x250
[ 0.000000] ERA: 90000000037a5f0c efi_runtime_init+0x30/0x94
[ 0.000000] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)
[ 0.000000] PRMD: 00000000 (PPLV0 -PIE -PWE)
[ 0.000000] EUEN: 00000000 (-FPE -SXE -ASXE -BTE)
[ 0.000000] ECFG: 00070800 (LIE=11 VS=7)
[ 0.000000] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)
[ 0.000000] BADV: 0000420000004259
[ 0.000000] PRID: 0014c010 (Loongson-64bit, Loongson-3A5000)
[ 0.000000] Modules linked in:
[ 0.000000] Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____))
[ 0.000000] Stack : 9000000003c93a14 9000000003800898 90000000041844f8 90000000037a46ec
[ 0.000000] 000000000a7fd000 0000000008290000 0000000000000000 0000000000000000
[ 0.000000] 0000000000000000 0000000000000000 00000000019d8000 000000000f556b60
[ 0.000000] 000000000a7fd000 000000000f556b08 9000000003ca7700 9000000003800000
[ 0.000000] 9000000003c93e50 9000000003800898 9000000003800108 90000000037a484c
[ 0.000000] 000000000e0a4330 000000000f556b60 000000000a7fd000 000000000f556b08
[ 0.000000] 9000000003ca7700 9000000004184000 0000000000200000 000000000e02b018
[ 0.000000] 000000000a7fd000 90000000037a0790 9000000003800108 0000000000000000
[ 0.000000] 0000000000000000 000000000e0a4330 000000000f556b60 000000000a7fd000
[ 0.000000] 000000000f556b08 000000000eaae298 000000000eaa5040 0000000000200000
[ 0.000000] ...
[ 0.000000] Call Trace:
[ 0.000000] [<90000000037a5f0c>] efi_runtime_init+0x30/0x94
[ 0.000000] [<90000000037a46ec>] platform_init+0x214/0x250
[ 0.000000] [<90000000037a484c>] setup_arch+0x124/0x45c
[ 0.000000] [<90000000037a0790>] start_kernel+0x90/0x670
[ 0.000000] [<900000000378b0d8>] kernel_entry+0xd8/0xdc
Severity
7.2 (High)
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-03 19:30 UTC
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
fa96b57c149061f71a70bd6582d995f6424fbbf4 , < 88e189bd16e5889e44a41b3309558ebab78b9280
(git)
Affected: fa96b57c149061f71a70bd6582d995f6424fbbf4 , < 0f6810e39898af2d2cabd9313e4dbc945fb5dfdd (git) Affected: fa96b57c149061f71a70bd6582d995f6424fbbf4 , < 4551b30525cf3d2f026b92401ffe241eb04dfebe (git) |
guessed | |
| Linux | Linux |
Affected:
5.19
Unaffected: 0 , < 5.19 (semver) Unaffected: 6.6.19 , ≤ 6.6.* (semver) Unaffected: 6.7.7 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-26768",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-03T19:30:26.181836Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-07T19:36:27.034Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:14:13.501Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/88e189bd16e5889e44a41b3309558ebab78b9280"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/0f6810e39898af2d2cabd9313e4dbc945fb5dfdd"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/4551b30525cf3d2f026b92401ffe241eb04dfebe"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/loongarch/include/asm/acpi.h",
"arch/loongarch/kernel/acpi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "88e189bd16e5889e44a41b3309558ebab78b9280",
"status": "affected",
"version": "fa96b57c149061f71a70bd6582d995f6424fbbf4",
"versionType": "git"
},
{
"lessThan": "0f6810e39898af2d2cabd9313e4dbc945fb5dfdd",
"status": "affected",
"version": "fa96b57c149061f71a70bd6582d995f6424fbbf4",
"versionType": "git"
},
{
"lessThan": "4551b30525cf3d2f026b92401ffe241eb04dfebe",
"status": "affected",
"version": "fa96b57c149061f71a70bd6582d995f6424fbbf4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/loongarch/include/asm/acpi.h",
"arch/loongarch/kernel/acpi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.7.*",
"status": "unaffected",
"version": "6.7.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.8",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.19",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.7.7",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Change acpi_core_pic[NR_CPUS] to acpi_core_pic[MAX_CORE_PIC]\n\nWith default config, the value of NR_CPUS is 64. When HW platform has\nmore then 64 cpus, system will crash on these platforms. MAX_CORE_PIC\nis the maximum cpu number in MADT table (max physical number) which can\nexceed the supported maximum cpu number (NR_CPUS, max logical number),\nbut kernel should not crash. Kernel should boot cpus with NR_CPUS, let\nthe remainder cpus stay in BIOS.\n\nThe potential crash reason is that the array acpi_core_pic[NR_CPUS] can\nbe overflowed when parsing MADT table, and it is obvious that CORE_PIC\nshould be corresponding to physical core rather than logical core, so it\nis better to define the array as acpi_core_pic[MAX_CORE_PIC].\n\nWith the patch, system can boot up 64 vcpus with qemu parameter -smp 128,\notherwise system will crash with the following message.\n\n[ 0.000000] CPU 0 Unable to handle kernel paging request at virtual address 0000420000004259, era == 90000000037a5f0c, ra == 90000000037a46ec\n[ 0.000000] Oops[#1]:\n[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.8.0-rc2+ #192\n[ 0.000000] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022\n[ 0.000000] pc 90000000037a5f0c ra 90000000037a46ec tp 9000000003c90000 sp 9000000003c93d60\n[ 0.000000] a0 0000000000000019 a1 9000000003d93bc0 a2 0000000000000000 a3 9000000003c93bd8\n[ 0.000000] a4 9000000003c93a74 a5 9000000083c93a67 a6 9000000003c938f0 a7 0000000000000005\n[ 0.000000] t0 0000420000004201 t1 0000000000000000 t2 0000000000000001 t3 0000000000000001\n[ 0.000000] t4 0000000000000003 t5 0000000000000000 t6 0000000000000030 t7 0000000000000063\n[ 0.000000] t8 0000000000000014 u0 ffffffffffffffff s9 0000000000000000 s0 9000000003caee98\n[ 0.000000] s1 90000000041b0480 s2 9000000003c93da0 s3 9000000003c93d98 s4 9000000003c93d90\n[ 0.000000] s5 9000000003caa000 s6 000000000a7fd000 s7 000000000f556b60 s8 000000000e0a4330\n[ 0.000000] ra: 90000000037a46ec platform_init+0x214/0x250\n[ 0.000000] ERA: 90000000037a5f0c efi_runtime_init+0x30/0x94\n[ 0.000000] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)\n[ 0.000000] PRMD: 00000000 (PPLV0 -PIE -PWE)\n[ 0.000000] EUEN: 00000000 (-FPE -SXE -ASXE -BTE)\n[ 0.000000] ECFG: 00070800 (LIE=11 VS=7)\n[ 0.000000] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)\n[ 0.000000] BADV: 0000420000004259\n[ 0.000000] PRID: 0014c010 (Loongson-64bit, Loongson-3A5000)\n[ 0.000000] Modules linked in:\n[ 0.000000] Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____))\n[ 0.000000] Stack : 9000000003c93a14 9000000003800898 90000000041844f8 90000000037a46ec\n[ 0.000000] 000000000a7fd000 0000000008290000 0000000000000000 0000000000000000\n[ 0.000000] 0000000000000000 0000000000000000 00000000019d8000 000000000f556b60\n[ 0.000000] 000000000a7fd000 000000000f556b08 9000000003ca7700 9000000003800000\n[ 0.000000] 9000000003c93e50 9000000003800898 9000000003800108 90000000037a484c\n[ 0.000000] 000000000e0a4330 000000000f556b60 000000000a7fd000 000000000f556b08\n[ 0.000000] 9000000003ca7700 9000000004184000 0000000000200000 000000000e02b018\n[ 0.000000] 000000000a7fd000 90000000037a0790 9000000003800108 0000000000000000\n[ 0.000000] 0000000000000000 000000000e0a4330 000000000f556b60 000000000a7fd000\n[ 0.000000] 000000000f556b08 000000000eaae298 000000000eaa5040 0000000000200000\n[ 0.000000] ...\n[ 0.000000] Call Trace:\n[ 0.000000] [\u003c90000000037a5f0c\u003e] efi_runtime_init+0x30/0x94\n[ 0.000000] [\u003c90000000037a46ec\u003e] platform_init+0x214/0x250\n[ 0.000000] [\u003c90000000037a484c\u003e] setup_arch+0x124/0x45c\n[ 0.000000] [\u003c90000000037a0790\u003e] start_kernel+0x90/0x670\n[ 0.000000] [\u003c900000000378b0d8\u003e] kernel_entry+0xd8/0xdc"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The overflow is reached only from `__init` MADT parsing during `setup_arch()`, with input supplied by platform firmware, the hypervisor\u0027s VM configuration, or a root-supplied initrd ACPI table override \u2014 all of which require local control of the machine\u0027s boot environment rather than physical presence.\nAC:L - The out-of-bounds store is deterministic \u2014 any MADT `Core PIC` entry with `core_id \u003e= NR_CPUS` reliably writes past `acpi_core_pic[]`, with no race to win and no memory layout the attacker cannot already influence.\nPR:H - This is pre-userspace code, so no unprivileged or namespace-based path exists; supplying the MADT requires firmware control, hypervisor/VM-configuration control, or real root to plant an initrd table override (itself blocked under kernel lockdown).\nUI:N - Once the crafted or oversized MADT is in place the corruption occurs automatically on the next boot, with no action required from any other user.\nS:U - The out-of-bounds write corrupts kernel `.bss` within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed by the overflow itself.\nC:H - Writing a 20-byte structure at an unvalidated `u32`-scaled offset corrupts arbitrary adjacent kernel globals, and such memory corruption of early-boot state (EFI/`loongson_sysconf` structures, pointers used later by the kernel) is leverageable to disclose kernel memory.\nI:H - This is a direct out-of-bounds write of attacker/firmware-controlled contents at an attacker-influenced index, giving a powerful write primitive over kernel data \u2014 per guidance, OOB writes score High.\nA:H - The documented result is a kernel Oops in `efi_runtime_init` during `start_kernel()`, rendering the system unbootable \u2014 a complete availability loss."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:27:07.626Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/88e189bd16e5889e44a41b3309558ebab78b9280"
},
{
"url": "https://git.kernel.org/stable/c/0f6810e39898af2d2cabd9313e4dbc945fb5dfdd"
},
{
"url": "https://git.kernel.org/stable/c/4551b30525cf3d2f026b92401ffe241eb04dfebe"
}
],
"title": "LoongArch: Change acpi_core_pic[NR_CPUS] to acpi_core_pic[MAX_CORE_PIC]",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-26768",
"datePublished": "2024-04-03T17:00:50.135Z",
"dateReserved": "2024-02-19T14:20:24.173Z",
"dateUpdated": "2026-08-05T11:27:07.626Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2024-26768",
"date": "2026-09-16",
"epss": "0.00598",
"percentile": "0.47049"
},
"fkie_nvd": {
"descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nLoongArch: Change acpi_core_pic[NR_CPUS] to acpi_core_pic[MAX_CORE_PIC]\\n\\nWith default config, the value of NR_CPUS is 64. When HW platform has\\nmore then 64 cpus, system will crash on these platforms. MAX_CORE_PIC\\nis the maximum cpu number in MADT table (max physical number) which can\\nexceed the supported maximum cpu number (NR_CPUS, max logical number),\\nbut kernel should not crash. Kernel should boot cpus with NR_CPUS, let\\nthe remainder cpus stay in BIOS.\\n\\nThe potential crash reason is that the array acpi_core_pic[NR_CPUS] can\\nbe overflowed when parsing MADT table, and it is obvious that CORE_PIC\\nshould be corresponding to physical core rather than logical core, so it\\nis better to define the array as acpi_core_pic[MAX_CORE_PIC].\\n\\nWith the patch, system can boot up 64 vcpus with qemu parameter -smp 128,\\notherwise system will crash with the following message.\\n\\n[ 0.000000] CPU 0 Unable to handle kernel paging request at virtual address 0000420000004259, era == 90000000037a5f0c, ra == 90000000037a46ec\\n[ 0.000000] Oops[#1]:\\n[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.8.0-rc2+ #192\\n[ 0.000000] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022\\n[ 0.000000] pc 90000000037a5f0c ra 90000000037a46ec tp 9000000003c90000 sp 9000000003c93d60\\n[ 0.000000] a0 0000000000000019 a1 9000000003d93bc0 a2 0000000000000000 a3 9000000003c93bd8\\n[ 0.000000] a4 9000000003c93a74 a5 9000000083c93a67 a6 9000000003c938f0 a7 0000000000000005\\n[ 0.000000] t0 0000420000004201 t1 0000000000000000 t2 0000000000000001 t3 0000000000000001\\n[ 0.000000] t4 0000000000000003 t5 0000000000000000 t6 0000000000000030 t7 0000000000000063\\n[ 0.000000] t8 0000000000000014 u0 ffffffffffffffff s9 0000000000000000 s0 9000000003caee98\\n[ 0.000000] s1 90000000041b0480 s2 9000000003c93da0 s3 9000000003c93d98 s4 9000000003c93d90\\n[ 0.000000] s5 9000000003caa000 s6 000000000a7fd000 s7 000000000f556b60 s8 000000000e0a4330\\n[ 0.000000] ra: 90000000037a46ec platform_init+0x214/0x250\\n[ 0.000000] ERA: 90000000037a5f0c efi_runtime_init+0x30/0x94\\n[ 0.000000] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)\\n[ 0.000000] PRMD: 00000000 (PPLV0 -PIE -PWE)\\n[ 0.000000] EUEN: 00000000 (-FPE -SXE -ASXE -BTE)\\n[ 0.000000] ECFG: 00070800 (LIE=11 VS=7)\\n[ 0.000000] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)\\n[ 0.000000] BADV: 0000420000004259\\n[ 0.000000] PRID: 0014c010 (Loongson-64bit, Loongson-3A5000)\\n[ 0.000000] Modules linked in:\\n[ 0.000000] Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____))\\n[ 0.000000] Stack : 9000000003c93a14 9000000003800898 90000000041844f8 90000000037a46ec\\n[ 0.000000] 000000000a7fd000 0000000008290000 0000000000000000 0000000000000000\\n[ 0.000000] 0000000000000000 0000000000000000 00000000019d8000 000000000f556b60\\n[ 0.000000] 000000000a7fd000 000000000f556b08 9000000003ca7700 9000000003800000\\n[ 0.000000] 9000000003c93e50 9000000003800898 9000000003800108 90000000037a484c\\n[ 0.000000] 000000000e0a4330 000000000f556b60 000000000a7fd000 000000000f556b08\\n[ 0.000000] 9000000003ca7700 9000000004184000 0000000000200000 000000000e02b018\\n[ 0.000000] 000000000a7fd000 90000000037a0790 9000000003800108 0000000000000000\\n[ 0.000000] 0000000000000000 000000000e0a4330 000000000f556b60 000000000a7fd000\\n[ 0.000000] 000000000f556b08 000000000eaae298 000000000eaa5040 0000000000200000\\n[ 0.000000] ...\\n[ 0.000000] Call Trace:\\n[ 0.000000] [\u003c90000000037a5f0c\u003e] efi_runtime_init+0x30/0x94\\n[ 0.000000] [\u003c90000000037a46ec\u003e] platform_init+0x214/0x250\\n[ 0.000000] [\u003c90000000037a484c\u003e] setup_arch+0x124/0x45c\\n[ 0.000000] [\u003c90000000037a0790\u003e] start_kernel+0x90/0x670\\n[ 0.000000] [\u003c900000000378b0d8\u003e] kernel_entry+0xd8/0xdc\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: LoongArch: cambie acpi_core_pic[NR_CPUS] a acpi_core_pic[MAX_CORE_PIC] Con la configuraci\\u00f3n predeterminada, el valor de NR_CPUS es 64. Cuando la plataforma HW tiene m\\u00e1s de 64 cpus, el SYSTEM fallar\\u00e1 en estas plataformas . MAX_CORE_PIC es el n\\u00famero m\\u00e1ximo de CPU en la tabla MADT (n\\u00famero f\\u00edsico m\\u00e1ximo) que puede exceder el n\\u00famero m\\u00e1ximo de CPU admitido (NR_CPUS, n\\u00famero l\\u00f3gico m\\u00e1ximo), pero el kernel no deber\\u00eda fallar. El kernel debe arrancar los procesadores con NR_CPUS y dejar que los procesadores restantes permanezcan en el BIOS. La posible raz\\u00f3n del fallo es que la matriz acpi_core_pic[NR_CPUS] puede desbordarse al analizar la tabla MADT, y es obvio que CORE_PIC debe corresponder al n\\u00facleo f\\u00edsico en lugar del n\\u00facleo l\\u00f3gico, por lo que es mejor definir la matriz como acpi_core_pic[MAX_CORE_PIC] . Con el parche, el SYSTEM puede iniciar 64 vcpus con el par\\u00e1metro qemu -smp 128; de lo contrario, el SYSTEM fallar\\u00e1 con el siguiente mensaje. [ 0.000000] CPU 0 No se puede manejar la solicitud de paginaci\\u00f3n del kernel en la direcci\\u00f3n virtual 0000420000004259, era == 90000000037a5f0c, ra == 90000000037a46ec [ 0.000000] Ups[#1]: [ 0.000000] CPU: 0 PID: 0 Comm: intercambiador No contaminado 6.8. 0-rc2+ #192 [0.000000] Nombre de hardware: QEMU QEMU M\\u00e1quina virtual, BIOS desconocido 2/2/2022 [0.000000] pc 90000000037a5f0c ra 90000000037a46ec tp 9000000003c90000 sp 9000000003c93 d60 [ 0.000000] a0 0000000000000019 a1 9000000003d93bc0 a2 0000000000000000 a3 9000000003c93bd8 [ 0.000000] a4 9000000003c93a74 a5 9000000083c93a67 a6 9000000003c938f0 a7 0000000000000005 [ 0.000000] t0 0000420000004201 t1 00000000000000000 t2 0000000000000000 1 t3 0000000000000001 [ 0,000000] t4 0000000000000003 t5 0000000000000000 t6 0000000000000030 t7 0000000000000063 [ 0,000000] t8 0000 000000000014 u0 ffffffffffffffff s9 0000000000000000 s0 9000000003caee98 [ 0.000000] s1 90000000041b0480 s2 9000000003c93da0 s3 9000000003 c93d98 s4 9000000003c93d90 [ 0.000000] s5 9000000003caa000 s6 000000000a7fd000 s7 000000000f556b60 s8 000000000e0a4330 [ 0.000000] ra: 90000000037a46ec platform_init+ 0x214/0x250 [ 0.000000] ERA: 90000000037a5f0c efi_runtime_init+0x30/0x94 [ 0.000000] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) [ 0.000000] PRMD: 00000000 (PPLV0 -PIE -PWE) [ 0.000000] EUEN: 00000000 (-FPE -SXE -ASXE -BTE) [ 0.000000] ECFG: 00070800 (LIE=11 VS=7) [ 0.000000] ESTAT: 00010000 [PIL] (IS= ECode=1 EssubCode=0) [ 0.000000] BADV: 0000420000004259 [ 0.000000] PRID: 0014c010 (Loongson-64bit, Loongson-3A5000) [ 0.0000 00] M\\u00f3dulos vinculados en: [ 0.000000] Proceso swapper (pid: 0, threadinfo=(____ptrval____), tarea=(____ptrval____)) [0.000000] Pila: 9000000003c93a14 9000000003800898 90000000041844f8 90000000037a46ec [0.000000] 000000000a7fd000 0000000008290000 0000000000000000 0000000000000000 [ 0.000000] 00000000000000000 0000000000000000 00000000019d 8000 000000000f556b60 [ 0,000000] 000000000a7fd000 000000000f556b08 9000000003ca7700 9000000003800000 [ 0,000000 ] 9000000003c93e50 9000000003800898 9000000003800108 90000000037a484c [ 0.000000] 000000000e0a4330 000000000f556b60 00000000 0a7fd000 000000000f556b08 [ 0.000000] 9000000003ca7700 9000000004184000 0000000000200000 000000000e02b018 [ 0.000000] 000000000a 7fd000 90000000037a0790 9000000003800108 0000000000000000 [ 0.000000] 00000000000000000 000000000e0a4330 000000000f556b60 00000 0000a7fd000 [ 0.000000] 000000000f556b08 000000000eaae298 000000000eaa5040 0000000000200000 [ 0.000000] ... [ 0.000000] Llamar Seguimiento: [ 0.000000] [\u0026lt;90000000037a5f0c\u0026gt;] efi_runtime_init+0x30/0x94 [ 0.000000] [\u0026lt;90000000037a46ec\u0026gt;] platform_init+0x214/0x250 [ 0.000000] [\u0026lt;90000000037a48 4c\u0026gt;] setup_arch+0x124/0x45c [ 0.000000] [\u0026lt;90000000037a0790\u0026gt;] start_kernel +0x90/0x670 [ 0.000000] [\u0026lt;900000000378b0d8\u0026gt;] entrada_kernel+0xd8/0xdc\"}]",
"id": "CVE-2024-26768",
"lastModified": "2024-11-21T09:03:01.570",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.0, \"impactScore\": 4.0}]}",
"published": "2024-04-03T17:15:52.800",
"references": "[{\"url\": \"https://git.kernel.org/stable/c/0f6810e39898af2d2cabd9313e4dbc945fb5dfdd\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/4551b30525cf3d2f026b92401ffe241eb04dfebe\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/88e189bd16e5889e44a41b3309558ebab78b9280\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/0f6810e39898af2d2cabd9313e4dbc945fb5dfdd\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/4551b30525cf3d2f026b92401ffe241eb04dfebe\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/88e189bd16e5889e44a41b3309558ebab78b9280\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Awaiting Analysis",
"weaknesses": "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-120\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-26768\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-03T17:15:52.800\",\"lastModified\":\"2026-08-04T11:17:02.413\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nLoongArch: Change acpi_core_pic[NR_CPUS] to acpi_core_pic[MAX_CORE_PIC]\\n\\nWith default config, the value of NR_CPUS is 64. When HW platform has\\nmore then 64 cpus, system will crash on these platforms. MAX_CORE_PIC\\nis the maximum cpu number in MADT table (max physical number) which can\\nexceed the supported maximum cpu number (NR_CPUS, max logical number),\\nbut kernel should not crash. Kernel should boot cpus with NR_CPUS, let\\nthe remainder cpus stay in BIOS.\\n\\nThe potential crash reason is that the array acpi_core_pic[NR_CPUS] can\\nbe overflowed when parsing MADT table, and it is obvious that CORE_PIC\\nshould be corresponding to physical core rather than logical core, so it\\nis better to define the array as acpi_core_pic[MAX_CORE_PIC].\\n\\nWith the patch, system can boot up 64 vcpus with qemu parameter -smp 128,\\notherwise system will crash with the following message.\\n\\n[ 0.000000] CPU 0 Unable to handle kernel paging request at virtual address 0000420000004259, era == 90000000037a5f0c, ra == 90000000037a46ec\\n[ 0.000000] Oops[#1]:\\n[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.8.0-rc2+ #192\\n[ 0.000000] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022\\n[ 0.000000] pc 90000000037a5f0c ra 90000000037a46ec tp 9000000003c90000 sp 9000000003c93d60\\n[ 0.000000] a0 0000000000000019 a1 9000000003d93bc0 a2 0000000000000000 a3 9000000003c93bd8\\n[ 0.000000] a4 9000000003c93a74 a5 9000000083c93a67 a6 9000000003c938f0 a7 0000000000000005\\n[ 0.000000] t0 0000420000004201 t1 0000000000000000 t2 0000000000000001 t3 0000000000000001\\n[ 0.000000] t4 0000000000000003 t5 0000000000000000 t6 0000000000000030 t7 0000000000000063\\n[ 0.000000] t8 0000000000000014 u0 ffffffffffffffff s9 0000000000000000 s0 9000000003caee98\\n[ 0.000000] s1 90000000041b0480 s2 9000000003c93da0 s3 9000000003c93d98 s4 9000000003c93d90\\n[ 0.000000] s5 9000000003caa000 s6 000000000a7fd000 s7 000000000f556b60 s8 000000000e0a4330\\n[ 0.000000] ra: 90000000037a46ec platform_init+0x214/0x250\\n[ 0.000000] ERA: 90000000037a5f0c efi_runtime_init+0x30/0x94\\n[ 0.000000] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)\\n[ 0.000000] PRMD: 00000000 (PPLV0 -PIE -PWE)\\n[ 0.000000] EUEN: 00000000 (-FPE -SXE -ASXE -BTE)\\n[ 0.000000] ECFG: 00070800 (LIE=11 VS=7)\\n[ 0.000000] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)\\n[ 0.000000] BADV: 0000420000004259\\n[ 0.000000] PRID: 0014c010 (Loongson-64bit, Loongson-3A5000)\\n[ 0.000000] Modules linked in:\\n[ 0.000000] Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____))\\n[ 0.000000] Stack : 9000000003c93a14 9000000003800898 90000000041844f8 90000000037a46ec\\n[ 0.000000] 000000000a7fd000 0000000008290000 0000000000000000 0000000000000000\\n[ 0.000000] 0000000000000000 0000000000000000 00000000019d8000 000000000f556b60\\n[ 0.000000] 000000000a7fd000 000000000f556b08 9000000003ca7700 9000000003800000\\n[ 0.000000] 9000000003c93e50 9000000003800898 9000000003800108 90000000037a484c\\n[ 0.000000] 000000000e0a4330 000000000f556b60 000000000a7fd000 000000000f556b08\\n[ 0.000000] 9000000003ca7700 9000000004184000 0000000000200000 000000000e02b018\\n[ 0.000000] 000000000a7fd000 90000000037a0790 9000000003800108 0000000000000000\\n[ 0.000000] 0000000000000000 000000000e0a4330 000000000f556b60 000000000a7fd000\\n[ 0.000000] 000000000f556b08 000000000eaae298 000000000eaa5040 0000000000200000\\n[ 0.000000] ...\\n[ 0.000000] Call Trace:\\n[ 0.000000] [\u003c90000000037a5f0c\u003e] efi_runtime_init+0x30/0x94\\n[ 0.000000] [\u003c90000000037a46ec\u003e] platform_init+0x214/0x250\\n[ 0.000000] [\u003c90000000037a484c\u003e] setup_arch+0x124/0x45c\\n[ 0.000000] [\u003c90000000037a0790\u003e] start_kernel+0x90/0x670\\n[ 0.000000] [\u003c900000000378b0d8\u003e] kernel_entry+0xd8/0xdc\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: LoongArch: cambie acpi_core_pic[NR_CPUS] a acpi_core_pic[MAX_CORE_PIC] Con la configuraci\u00f3n predeterminada, el valor de NR_CPUS es 64. Cuando la plataforma HW tiene m\u00e1s de 64 cpus, el SYSTEM fallar\u00e1 en estas plataformas . MAX_CORE_PIC es el n\u00famero m\u00e1ximo de CPU en la tabla MADT (n\u00famero f\u00edsico m\u00e1ximo) que puede exceder el n\u00famero m\u00e1ximo de CPU admitido (NR_CPUS, n\u00famero l\u00f3gico m\u00e1ximo), pero el kernel no deber\u00eda fallar. El kernel debe arrancar los procesadores con NR_CPUS y dejar que los procesadores restantes permanezcan en el BIOS. La posible raz\u00f3n del fallo es que la matriz acpi_core_pic[NR_CPUS] puede desbordarse al analizar la tabla MADT, y es obvio que CORE_PIC debe corresponder al n\u00facleo f\u00edsico en lugar del n\u00facleo l\u00f3gico, por lo que es mejor definir la matriz como acpi_core_pic[MAX_CORE_PIC] . Con el parche, el SYSTEM puede iniciar 64 vcpus con el par\u00e1metro qemu -smp 128; de lo contrario, el SYSTEM fallar\u00e1 con el siguiente mensaje. [ 0.000000] CPU 0 No se puede manejar la solicitud de paginaci\u00f3n del kernel en la direcci\u00f3n virtual 0000420000004259, era == 90000000037a5f0c, ra == 90000000037a46ec [ 0.000000] Ups[#1]: [ 0.000000] CPU: 0 PID: 0 Comm: intercambiador No contaminado 6.8. 0-rc2+ #192 [0.000000] Nombre de hardware: QEMU QEMU M\u00e1quina virtual, BIOS desconocido 2/2/2022 [0.000000] pc 90000000037a5f0c ra 90000000037a46ec tp 9000000003c90000 sp 9000000003c93 d60 [ 0.000000] a0 0000000000000019 a1 9000000003d93bc0 a2 0000000000000000 a3 9000000003c93bd8 [ 0.000000] a4 9000000003c93a74 a5 9000000083c93a67 a6 9000000003c938f0 a7 0000000000000005 [ 0.000000] t0 0000420000004201 t1 00000000000000000 t2 0000000000000000 1 t3 0000000000000001 [ 0,000000] t4 0000000000000003 t5 0000000000000000 t6 0000000000000030 t7 0000000000000063 [ 0,000000] t8 0000 000000000014 u0 ffffffffffffffff s9 0000000000000000 s0 9000000003caee98 [ 0.000000] s1 90000000041b0480 s2 9000000003c93da0 s3 9000000003 c93d98 s4 9000000003c93d90 [ 0.000000] s5 9000000003caa000 s6 000000000a7fd000 s7 000000000f556b60 s8 000000000e0a4330 [ 0.000000] ra: 90000000037a46ec platform_init+ 0x214/0x250 [ 0.000000] ERA: 90000000037a5f0c efi_runtime_init+0x30/0x94 [ 0.000000] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) [ 0.000000] PRMD: 00000000 (PPLV0 -PIE -PWE) [ 0.000000] EUEN: 00000000 (-FPE -SXE -ASXE -BTE) [ 0.000000] ECFG: 00070800 (LIE=11 VS=7) [ 0.000000] ESTAT: 00010000 [PIL] (IS= ECode=1 EssubCode=0) [ 0.000000] BADV: 0000420000004259 [ 0.000000] PRID: 0014c010 (Loongson-64bit, Loongson-3A5000) [ 0.0000 00] M\u00f3dulos vinculados en: [ 0.000000] Proceso swapper (pid: 0, threadinfo=(____ptrval____), tarea=(____ptrval____)) [0.000000] Pila: 9000000003c93a14 9000000003800898 90000000041844f8 90000000037a46ec [0.000000] 000000000a7fd000 0000000008290000 0000000000000000 0000000000000000 [ 0.000000] 00000000000000000 0000000000000000 00000000019d 8000 000000000f556b60 [ 0,000000] 000000000a7fd000 000000000f556b08 9000000003ca7700 9000000003800000 [ 0,000000 ] 9000000003c93e50 9000000003800898 9000000003800108 90000000037a484c [ 0.000000] 000000000e0a4330 000000000f556b60 00000000 0a7fd000 000000000f556b08 [ 0.000000] 9000000003ca7700 9000000004184000 0000000000200000 000000000e02b018 [ 0.000000] 000000000a 7fd000 90000000037a0790 9000000003800108 0000000000000000 [ 0.000000] 00000000000000000 000000000e0a4330 000000000f556b60 00000 0000a7fd000 [ 0.000000] 000000000f556b08 000000000eaae298 000000000eaa5040 0000000000200000 [ 0.000000] ... [ 0.000000] Llamar Seguimiento: [ 0.000000] [\u0026lt;90000000037a5f0c\u0026gt;] efi_runtime_init+0x30/0x94 [ 0.000000] [\u0026lt;90000000037a46ec\u0026gt;] platform_init+0x214/0x250 [ 0.000000] [\u0026lt;90000000037a48 4c\u0026gt;] setup_arch+0x124/0x45c [ 0.000000] [\u0026lt;90000000037a0790\u0026gt;] start_kernel +0x90/0x670 [ 0.000000] [\u0026lt;900000000378b0d8\u0026gt;] entrada_kernel+0xd8/0xdc\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/loongarch/include/asm/acpi.h\",\"arch/loongarch/kernel/acpi.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fa96b57c149061f71a70bd6582d995f6424fbbf4\",\"lessThan\":\"88e189bd16e5889e44a41b3309558ebab78b9280\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fa96b57c149061f71a70bd6582d995f6424fbbf4\",\"lessThan\":\"0f6810e39898af2d2cabd9313e4dbc945fb5dfdd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fa96b57c149061f71a70bd6582d995f6424fbbf4\",\"lessThan\":\"4551b30525cf3d2f026b92401ffe241eb04dfebe\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/loongarch/include/asm/acpi.h\",\"arch/loongarch/kernel/acpi.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.19\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.7\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":4.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-04-03T19:30:26.181836Z\",\"id\":\"CVE-2024-26768\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-120\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.19\",\"versionEndExcluding\":\"6.6.19\",\"matchCriteriaId\":\"296B2324-E9B8-417F-A82B-B8C508688E14\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.7\",\"matchCriteriaId\":\"575EE16B-67F2-4B5B-B5F8-1877715C898B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0f6810e39898af2d2cabd9313e4dbc945fb5dfdd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4551b30525cf3d2f026b92401ffe241eb04dfebe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/88e189bd16e5889e44a41b3309558ebab78b9280\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0f6810e39898af2d2cabd9313e4dbc945fb5dfdd\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4551b30525cf3d2f026b92401ffe241eb04dfebe\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/88e189bd16e5889e44a41b3309558ebab78b9280\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
"redhat_vex": {
"aggregate_severity": "Low",
"current_release_date": "2026-08-04T22:50:07+00:00",
"cve": "CVE-2024-26768",
"id": "CVE-2024-26768",
"initial_release_date": "2024-04-03T00:00:00+00:00",
"product_status:known_affected": "42",
"product_status:known_not_affected": "156",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: LoongArch: Change acpi_core_pic[NR_CPUS] to acpi_core_pic[MAX_CORE_PIC]",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26768.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "important",
"current_release_date": "2026-08-31T00:44:47Z",
"cve": "CVE-2024-26768",
"id": "CVE-2024-26768",
"initial_release_date": "2024-04-11T02:30:58Z",
"product_status:known_not_affected": "356",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2024-26768",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26768.json",
"version": "20"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/88e189bd16e5889e44a41b3309558ebab78b9280\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0f6810e39898af2d2cabd9313e4dbc945fb5dfdd\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4551b30525cf3d2f026b92401ffe241eb04dfebe\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.501Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26768\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-03T19:30:26.181836Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-120\", \"description\": \"CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:21.877Z\"}}], \"cna\": {\"title\": \"LoongArch: Change acpi_core_pic[NR_CPUS] to acpi_core_pic[MAX_CORE_PIC]\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.2, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The overflow is reached only from `__init` MADT parsing during `setup_arch()`, with input supplied by platform firmware, the hypervisor\u0027s VM configuration, or a root-supplied initrd ACPI table override \\u2014 all of which require local control of the machine\u0027s boot environment rather than physical presence.\\nAC:L - The out-of-bounds store is deterministic \\u2014 any MADT `Core PIC` entry with `core_id \u003e= NR_CPUS` reliably writes past `acpi_core_pic[]`, with no race to win and no memory layout the attacker cannot already influence.\\nPR:H - This is pre-userspace code, so no unprivileged or namespace-based path exists; supplying the MADT requires firmware control, hypervisor/VM-configuration control, or real root to plant an initrd table override (itself blocked under kernel lockdown).\\nUI:N - Once the crafted or oversized MADT is in place the corruption occurs automatically on the next boot, with no action required from any other user.\\nS:U - The out-of-bounds write corrupts kernel `.bss` within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed by the overflow itself.\\nC:H - Writing a 20-byte structure at an unvalidated `u32`-scaled offset corrupts arbitrary adjacent kernel globals, and such memory corruption of early-boot state (EFI/`loongson_sysconf` structures, pointers used later by the kernel) is leverageable to disclose kernel memory.\\nI:H - This is a direct out-of-bounds write of attacker/firmware-controlled contents at an attacker-influenced index, giving a powerful write primitive over kernel data \\u2014 per guidance, OOB writes score High.\\nA:H - The documented result is a kernel Oops in `efi_runtime_init` during `start_kernel()`, rendering the system unbootable \\u2014 a complete availability loss.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"fa96b57c149061f71a70bd6582d995f6424fbbf4\", \"lessThan\": \"88e189bd16e5889e44a41b3309558ebab78b9280\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fa96b57c149061f71a70bd6582d995f6424fbbf4\", \"lessThan\": \"0f6810e39898af2d2cabd9313e4dbc945fb5dfdd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fa96b57c149061f71a70bd6582d995f6424fbbf4\", \"lessThan\": \"4551b30525cf3d2f026b92401ffe241eb04dfebe\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/loongarch/include/asm/acpi.h\", \"arch/loongarch/kernel/acpi.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.19\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.19\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.19\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/loongarch/include/asm/acpi.h\", \"arch/loongarch/kernel/acpi.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/88e189bd16e5889e44a41b3309558ebab78b9280\"}, {\"url\": \"https://git.kernel.org/stable/c/0f6810e39898af2d2cabd9313e4dbc945fb5dfdd\"}, {\"url\": \"https://git.kernel.org/stable/c/4551b30525cf3d2f026b92401ffe241eb04dfebe\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nLoongArch: Change acpi_core_pic[NR_CPUS] to acpi_core_pic[MAX_CORE_PIC]\\n\\nWith default config, the value of NR_CPUS is 64. When HW platform has\\nmore then 64 cpus, system will crash on these platforms. MAX_CORE_PIC\\nis the maximum cpu number in MADT table (max physical number) which can\\nexceed the supported maximum cpu number (NR_CPUS, max logical number),\\nbut kernel should not crash. Kernel should boot cpus with NR_CPUS, let\\nthe remainder cpus stay in BIOS.\\n\\nThe potential crash reason is that the array acpi_core_pic[NR_CPUS] can\\nbe overflowed when parsing MADT table, and it is obvious that CORE_PIC\\nshould be corresponding to physical core rather than logical core, so it\\nis better to define the array as acpi_core_pic[MAX_CORE_PIC].\\n\\nWith the patch, system can boot up 64 vcpus with qemu parameter -smp 128,\\notherwise system will crash with the following message.\\n\\n[ 0.000000] CPU 0 Unable to handle kernel paging request at virtual address 0000420000004259, era == 90000000037a5f0c, ra == 90000000037a46ec\\n[ 0.000000] Oops[#1]:\\n[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.8.0-rc2+ #192\\n[ 0.000000] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022\\n[ 0.000000] pc 90000000037a5f0c ra 90000000037a46ec tp 9000000003c90000 sp 9000000003c93d60\\n[ 0.000000] a0 0000000000000019 a1 9000000003d93bc0 a2 0000000000000000 a3 9000000003c93bd8\\n[ 0.000000] a4 9000000003c93a74 a5 9000000083c93a67 a6 9000000003c938f0 a7 0000000000000005\\n[ 0.000000] t0 0000420000004201 t1 0000000000000000 t2 0000000000000001 t3 0000000000000001\\n[ 0.000000] t4 0000000000000003 t5 0000000000000000 t6 0000000000000030 t7 0000000000000063\\n[ 0.000000] t8 0000000000000014 u0 ffffffffffffffff s9 0000000000000000 s0 9000000003caee98\\n[ 0.000000] s1 90000000041b0480 s2 9000000003c93da0 s3 9000000003c93d98 s4 9000000003c93d90\\n[ 0.000000] s5 9000000003caa000 s6 000000000a7fd000 s7 000000000f556b60 s8 000000000e0a4330\\n[ 0.000000] ra: 90000000037a46ec platform_init+0x214/0x250\\n[ 0.000000] ERA: 90000000037a5f0c efi_runtime_init+0x30/0x94\\n[ 0.000000] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)\\n[ 0.000000] PRMD: 00000000 (PPLV0 -PIE -PWE)\\n[ 0.000000] EUEN: 00000000 (-FPE -SXE -ASXE -BTE)\\n[ 0.000000] ECFG: 00070800 (LIE=11 VS=7)\\n[ 0.000000] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)\\n[ 0.000000] BADV: 0000420000004259\\n[ 0.000000] PRID: 0014c010 (Loongson-64bit, Loongson-3A5000)\\n[ 0.000000] Modules linked in:\\n[ 0.000000] Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____))\\n[ 0.000000] Stack : 9000000003c93a14 9000000003800898 90000000041844f8 90000000037a46ec\\n[ 0.000000] 000000000a7fd000 0000000008290000 0000000000000000 0000000000000000\\n[ 0.000000] 0000000000000000 0000000000000000 00000000019d8000 000000000f556b60\\n[ 0.000000] 000000000a7fd000 000000000f556b08 9000000003ca7700 9000000003800000\\n[ 0.000000] 9000000003c93e50 9000000003800898 9000000003800108 90000000037a484c\\n[ 0.000000] 000000000e0a4330 000000000f556b60 000000000a7fd000 000000000f556b08\\n[ 0.000000] 9000000003ca7700 9000000004184000 0000000000200000 000000000e02b018\\n[ 0.000000] 000000000a7fd000 90000000037a0790 9000000003800108 0000000000000000\\n[ 0.000000] 0000000000000000 000000000e0a4330 000000000f556b60 000000000a7fd000\\n[ 0.000000] 000000000f556b08 000000000eaae298 000000000eaa5040 0000000000200000\\n[ 0.000000] ...\\n[ 0.000000] Call Trace:\\n[ 0.000000] [\u003c90000000037a5f0c\u003e] efi_runtime_init+0x30/0x94\\n[ 0.000000] [\u003c90000000037a46ec\u003e] platform_init+0x214/0x250\\n[ 0.000000] [\u003c90000000037a484c\u003e] setup_arch+0x124/0x45c\\n[ 0.000000] [\u003c90000000037a0790\u003e] start_kernel+0x90/0x670\\n[ 0.000000] [\u003c900000000378b0d8\u003e] kernel_entry+0xd8/0xdc\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.19\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.7\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"5.19\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:27:07.626Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-26768\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:27:07.626Z\", \"dateReserved\": \"2024-02-19T14:20:24.173Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-03T17:00:50.135Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…