SECUFOCUSNOW
Home›CVE index›CVE-2024-26768
Review reviewHigh

CVE-2024-26768

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Change acpi_core_pic[NR_CPUS] to acpi_core_pic[MAX_CORE_PIC] With default config, the value of NR_CPUS is 64. When HW platform has more then 64 cpus, system will crash on these platforms. MAX_CORE_PIC is the maximum cpu number in MADT table (max physical number) which can exceed the supported maximum cpu number (NR_CPUS, max logical number), but kernel should not crash. Kernel should boot cpus with NR_CPUS, let the remainder cpus stay in BIOS. The potential crash reason is that the array acpi_core_pic[NR_CPUS] ca...

CVSS
7.2
EPSS
0.60%
45.3% percentile
CISA KEV
Not listed
Published
2024.04.04
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.60%
Technical severityCVSS 7.2

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Change acpi_core_pic[NR_CPUS] to acpi_core_pic[MAX_CORE_PIC] With default config, the value of NR_CPUS is 64. When HW platform has more then 64 cpus, system will crash on these platforms. MAX_CORE_PIC is the maximum cpu number in MADT table (max physical number) which can exceed the supported maximum cpu number (NR_CPUS, max logical number), but kernel should not crash. Kernel should boot cpus with NR_CPUS, let the remainder cpus stay in BIOS. The potential crash reason is that the array acpi_core_pic[NR_CPUS] ca...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= fa96b57c149061f71a70bd6582d995f6424fbbf4 < 88e189bd16e5889e44a41b3309558ebab78b9280, >= fa96b57c149061f71a70bd6582d995f6424fbbf4 < 0f6810e39898af2d2cabd9313e4dbc945fb5dfdd, >= fa96b57c149061f71a70bd6582d995f6424fbbf4 < 4551b30525cf3d2f026b92401ffe241eb04dfebe, >= 5.19, >= 5.19 < 6.6.19, >= 6.7 < 6.7.7, 6.8
Fixed versions
6.6.19, 6.7.7

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-120
CVE-2024-26768 — Linux Linux, linux kernel | SECUFOCUS NOW