CVE-2024-26957

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: fix reference counting on zcrypt card objects Tests with hot-plugging crytpo cards on KVM guests with debug kernel build revealed an use after free for the load field of the struct zcrypt_card. The reason was an incorrect reference handling of the zcrypt card object which could lead to a free of the zcrypt card object while it was still in use. This is an example of the slab message: kernel: 0x00000000885a7512-0x00000000885a7513 @offset=1298. First byte 0x68 instead of 0x6b kernel: Allocated in zcrypt_card_allo...

Affected product and versions

Product

Linux Linux, linux_kernel, linux kernel

Affected versions

>= e28d2af43614eb86f59812e7221735fc221bbc10 < 7e500849fa558879a1cde43f80c7c048c2437058, >= e28d2af43614eb86f59812e7221735fc221bbc10 < 9daddee03de3f231012014dab8ab2b277a116a55, >= e28d2af43614eb86f59812e7221735fc221bbc10 < 6470078ab3d8f222115e11c4ec67351f3031b3dd, >= e28d2af43614eb86f59812e7221735fc221bbc10 < a55677878b93e9ebc31f66d0e2fb93be5e7836a6, >= e28d2af43614eb86f59812e7221735fc221bbc10 < b7f6c3630eb3f103115ab0d7613588064f665d0d, >= e28d2af43614eb86f59812e7221735fc221bbc10 < a64ab862e84e3e698cd351a87cdb504c7fc575ca, >= e28d2af43614eb86f59812e7221735fc221bbc10 < befb7f889594d23e1b475720cf93efd2f77df000, >= e28d2af43614eb86f59812e7221735fc221bbc10 < 394b6d8bbdf9ddee6d5bcf3e1f3e9f23eecd6484, >= e28d2af43614eb86f59812e7221735fc221bbc10 < 50ed48c80fecbe17218afed4f8bed005c802976c, >= 4.10, >= 1da177e4c3f4 < 7e500849fa55, >= 1da177e4c3f4 < 9daddee03de3, >= 1da177e4c3f4 < 6470078ab3d8, >= 1da177e4c3f4 < a55677878b93, >= 1da177e4c3f4 < b7f6c3630eb3, >= 1da177e4c3f4 < a64ab862e84e, >= 1da177e4c3f4 < befb7f889594, >= 1da177e4c3f4 < 394b6d8bbdf9, >= 1da177e4c3f4 < 50ed48c80fec, < 4.19.312

Fixed versions

4.19.312, 5.4.274, 5.10.215, 5.15.154, 6.1.84, 6.6.24, 6.7.12, 6.8.3

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416