#VU91524 Improper locking in Linux kernel - CVE-2024-26891

Vulnerability identifier: #VU91524

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26891

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the devtlb_invalidation_with_pasid() function in drivers/iommu/intel/pasid.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/f873b85ec762c5a6abe94a7ddb31df5d3ba07d85
https://git.kernel.org/stable/c/d70f1c85113cd8c2aa8373f491ca5d1b22ec0554
https://git.kernel.org/stable/c/34a7b30f56d30114bf4d436e4dc793afe326fbcf
https://git.kernel.org/stable/c/2b74b2a92e524d7c8dec8e02e95ecf18b667c062
https://git.kernel.org/stable/c/c04f2780919f20e2cc4846764221f5e802555868
https://git.kernel.org/stable/c/025bc6b41e020aeb1e71f84ae3ffce945026de05
https://git.kernel.org/stable/c/4fc82cd907ac075648789cc3a00877778aa1838b

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.