5.5

CVE-2024-26900: md: fix kmemleak of rdev->serial

Modified
AliasesUBUNTU-CVE-2024-26900DEBIAN-CVE-2024-26900
Published 17-04-2024Last modified 11-05-2026

Vulnerability summary

CVE-2024-26900 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 21.2% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.29%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 28 · Related 25
DLA-3843-1DSA-5703-1RHSA-2024:9315SUSE-SU-2024:1979-1SUSE-SU-2024:1983-1SUSE-SU-2024:2008-1

Timeline

  1. 17-04-2024
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: md: fix kmemleak of rdev->serial If kobject_add() is fail in bind_rdev_to_array(), 'rdev->serial' will be alloc not be freed, and kmemleak occurs. unreferenced object 0xffff88815a350000 (size 49152): comm "mdadm", pid 789, jiffies 4294716910 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc f773277a): [<0000000058b0a453>] kmemleak_alloc+0x61/0xe0 [<00000000366adf14>] __kmalloc_large_node+0x15e/0x270 [<000000002e82961b>] __kmalloc_node.cold+0x11/0x7f [<00000000f206d60a>] kvmalloc_node+0x74/0x150 [<0000000034bf3363>] rdev_init_serial+0x67/0x170 [<0000000010e08fe9>] mddev_create_serial_pool+0x62/0x220 [<00000000c3837bf0>] bind_rdev_to_array+0x2af/0x630 [<0000000073c28560>] md_add_new_disk+0x400/0x9f0 [<00000000770e30ff>] md_ioctl+0x15bf/0x1c10 [<000000006cfab718>] blkdev_ioctl+0x191/0x3f0 [<0000000085086a11>] vfs_ioctl+0x22/0x60 [<0000000018b656fe>] __x64_sys_ioctl+0xba/0xe0 [<00000000e54e675e>] do_syscall_64+0x71/0x150 [<000000008b0ad622>] entry_SYSCALL_64_after_hwframe+0x6c/0x74

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.29%

Chance of exploitation in the next 30 days

Percentile

21%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.28% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu113 products
  • linuxAll versions (No fix recorded) | < 5.15.0-118.128 | < 6.8.0-35.35
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1067.73 | < 6.8.0-1009.9
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 963c555e75b033202dd76cf6325a7b7c83d08d5f, < fb5b347efd1bda989846ffc74679d181222fb123 | ≥ 963c555e75b033202dd76cf6325a7b7c83d08d5f, < f3a1787dc48213f6caea5ba7d47e0222e7fa34a9 | ≥ 963c555e75b033202dd76cf6325a7b7c83d08d5f, < beaf11969fd5cbe6f09cefaa34df1ce8578e8dd9 | ≥ 963c555e75b033202dd76cf6325a7b7c83d08d5f, < 9fd0198f7ef06ae0d6636fb0578560857dead995 | ≥ 963c555e75b033202dd76cf6325a7b7c83d08d5f, < 6d32c832a88513f65c2c2c9c75954ee8b387adea | ≥ 963c555e75b033202dd76cf6325a7b7c83d08d5f, < 4c1021ce46fc2fb6115f7e79d353941e6dcad366 | ≥ 963c555e75b033202dd76cf6325a7b7c83d08d5f, < 6cf350658736681b9d6b0b6e58c5c76b235bb4c4 | 5.3
  • linux_kernel≥ 5.3, < 6.7.11 | ≥ 6.8, < 6.8.2
Debian1 product
  • linux< 6.1.94-1 | < 6.7.12-1

3 vendors · 116 products

References

26 links
Show all 26 references