Vulnerability identifier: #VU92007

Vulnerability risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26736

CWE-ID: CWE-119

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the afs_update_volume_status() function in fs/afs/volume.c. A local user can escalate privileges on the system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/5c27d85a69fa16a08813ba37ddfb4bbc9a1ed6b5
http://git.kernel.org/stable/c/d9b5e2b7a8196850383c70d099bfd39e81ab6637
http://git.kernel.org/stable/c/e56662160fc24d28cb75ac095cc6415ae1bda43e
http://git.kernel.org/stable/c/e8530b170e464017203e3b8c6c49af6e916aece1
http://git.kernel.org/stable/c/6e6065dd25b661420fac19c34282b6c626fcd35e
http://git.kernel.org/stable/c/d34a5e57632bb5ff825196ddd9a48ca403626dfa
http://git.kernel.org/stable/c/6ea38e2aeb72349cad50e38899b0ba6fbcb2af3d

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.