CVE-2024-26957: debian debian_linux Use After Free

CVSS: 7.8v3.1HighModified

AliasesUBUNTU-CVE-2024-26957DEBIAN-CVE-2024-26957

Published 01-05-2024Last modified 15-10-2026

Vulnerability summary

CVE-2024-26957 is a high (CVSS 7.8) Use After Free vulnerability in debian debian_linux. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.1% of scored vulnerabilities.

Overall risk

31/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.8/10

010

High · v3.1 (CVE.org)

EPSS score

0.24%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

01-05-2024
PublishedVulnerability first disclosed.
15-10-2026
Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: fix reference counting on zcrypt card objects Tests with hot-plugging crytpo cards on KVM guests with debug kernel build revealed an use after free for the load field of the struct zcrypt_card. The reason was an incorrect reference handling of the zcrypt card object which could lead to a free of the zcrypt card object while it was still in use. This is an example of the slab message: kernel: 0x00000000885a7512-0x00000000885a7513 @offset=1298. First byte 0x68 instead of 0x6b kernel: Allocated in zcrypt_card_alloc+0x36/0x70 [zcrypt] age=18046 cpu=3 pid=43 kernel: kmalloc_trace+0x3f2/0x470 kernel: zcrypt_card_alloc+0x36/0x70 [zcrypt] kernel: zcrypt_cex4_card_probe+0x26/0x380 [zcrypt_cex4] kernel: ap_device_probe+0x15c/0x290 kernel: really_probe+0xd2/0x468 kernel: driver_probe_device+0x40/0xf0 kernel: __device_attach_driver+0xc0/0x140 kernel: bus_for_each_drv+0x8c/0xd0 kernel: __device_attach+0x114/0x198 kernel: bus_probe_device+0xb4/0xc8 kernel: device_add+0x4d2/0x6e0 kernel: ap_scan_adapter+0x3d0/0x7c0 kernel: ap_scan_bus+0x5a/0x3b0 kernel: ap_scan_bus_wq_callback+0x40/0x60 kernel: process_one_work+0x26e/0x620 kernel: worker_thread+0x21c/0x440 kernel: Freed in zcrypt_card_put+0x54/0x80 [zcrypt] age=9024 cpu=3 pid=43 kernel: kfree+0x37e/0x418 kernel: zcrypt_card_put+0x54/0x80 [zcrypt] kernel: ap_device_remove+0x4c/0xe0 kernel: device_release_driver_internal+0x1c4/0x270 kernel: bus_remove_device+0x100/0x188 kernel: device_del+0x164/0x3c0 kernel: device_unregister+0x30/0x90 kernel: ap_scan_adapter+0xc8/0x7c0 kernel: ap_scan_bus+0x5a/0x3b0 kernel: ap_scan_bus_wq_callback+0x40/0x60 kernel: process_one_work+0x26e/0x620 kernel: worker_thread+0x21c/0x440 kernel: kthread+0x150/0x168 kernel: __ret_from_fork+0x3c/0x58 kernel: ret_from_fork+0xa/0x30 kernel: Slab 0x00000372022169c0 objects=20 used=18 fp=0x00000000885a7c88 flags=0x3ffff00000000a00(workingset|slab|node=0|zone=1|lastcpupid=0x1ffff) kernel: Object 0x00000000885a74b8 @offset=1208 fp=0x00000000885a7c88 kernel: Redzone 00000000885a74b0: bb bb bb bb bb bb bb bb ........ kernel: Object 00000000885a74b8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74c8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74d8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74e8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74f8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a7508: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 68 4b 6b 6b 6b a5 kkkkkkkkkkhKkkk. kernel: Redzone 00000000885a7518: bb bb bb bb bb bb bb bb ........ kernel: Padding 00000000885a756c: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZ kernel: CPU: 0 PID: 387 Comm: systemd-udevd Not tainted 6.8.0-HF #2 kernel: Hardware name: IBM 3931 A01 704 (KVM/Linux) kernel: Call Trace: kernel: [<00000000ca5ab5b8>] dump_stack_lvl+0x90/0x120 kernel: [<00000000c99d78bc>] check_bytes_and_report+0x114/0x140 kernel: [<00000000c99d53cc>] check_object+0x334/0x3f8 kernel: [<00000000c99d820c>] alloc_debug_processing+0xc4/0x1f8 kernel: [<00000000c99d852e>] get_partial_node.part.0+0x1ee/0x3e0 kernel: [<00000000c99d94ec>] ___slab_alloc+0xaf4/0x13c8 kernel: [<00000000c99d9e38>] __slab_alloc.constprop.0+0x78/0xb8 kernel: [<00000000c99dc8dc>] __kmalloc+0x434/0x590 kernel: [<00000000c9b4c0ce>] ext4_htree_store_dirent+0x4e/0x1c0 kernel: [<00000000c9b908a2>] htree_dirblock_to_tree+0x17a/0x3f0 kernel: ---truncated---

CVSS metrics

4 scores · 4 sources · 1 version

v3.17.8

EPSS trend

Probability

0.24%

Chance of exploitation in the next 30 days

Percentile

14%

Versus all other CVEs

30-day change

0.00 pp

From 0.24% on 18-09-2026

18-09-202618-10-2026

EPSS score

0.24%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Ubuntu118 products

linuxAll versions (No fix recorded) | < 5.4.0-189.209 | < 5.15.0-116.126 | < 6.8.0-35.35
linux-allwinner-5.19All versions (No fix recorded)
linux-awsAll versions (No fix recorded) | < 5.4.0-1128.138 | < 5.15.0-1065.71 | < 6.8.0-1009.9
linux-aws-5.0All versions (No fix recorded)
linux-aws-5.11All versions (No fix recorded)

linux-aws-5.13All versions (No fix recorded)
linux-aws-5.15< 5.15.0-1065.71~20.04.1
linux-aws-5.19All versions (No fix recorded)
linux-aws-5.3All versions (No fix recorded)
linux-aws-5.4< 5.4.0-1128.138~18.04.1
linux-aws-5.8All versions (No fix recorded)
linux-aws-6.2All versions (No fix recorded)
linux-aws-6.5All versions (No fix recorded)
linux-aws-fipsAll versions (No fix recorded) | < 5.4.0-1128.138+fips1 | < 5.15.0-1065.71+fips1
linux-aws-hweAll versions (No fix recorded)
linux-azureAll versions (No fix recorded) | < 5.4.0-1133.140 | < 5.15.0-1068.77 | < 6.8.0-1008.8
linux-azure-4.15All versions (No fix recorded)
linux-azure-5.11All versions (No fix recorded)
linux-azure-5.13All versions (No fix recorded)
linux-azure-5.15< 5.15.0-1068.77~20.04.1
linux-azure-5.19All versions (No fix recorded)
linux-azure-5.3All versions (No fix recorded)
linux-azure-5.4< 5.4.0-1133.140~18.04.1
linux-azure-5.8All versions (No fix recorded)
linux-azure-6.2All versions (No fix recorded)
linux-azure-6.5All versions (No fix recorded)
linux-azure-edgeAll versions (No fix recorded)
linux-azure-fdeAll versions (No fix recorded) | < 5.15.0-1068.77.1
linux-azure-fde-5.15< 5.15.0-1114.123~20.04.1
linux-azure-fde-5.19All versions (No fix recorded)
linux-azure-fde-6.2All versions (No fix recorded)
linux-azure-fipsAll versions (No fix recorded) | < 5.4.0-1133.140+fips1 | < 5.15.0-1068.77+fips1
linux-bluefield< 5.4.0-1088.95 | < 5.15.0-1047.49
linux-fipsAll versions (No fix recorded) | < 5.4.0-1102.112 | < 5.15.0-115.125+fips1
linux-gcpAll versions (No fix recorded) | < 5.4.0-1132.141 | < 5.15.0-1064.72 | < 6.8.0-1008.9
linux-gcp-4.15All versions (No fix recorded)
linux-gcp-5.11All versions (No fix recorded)
linux-gcp-5.13All versions (No fix recorded)
linux-gcp-5.15< 5.15.0-1065.73~20.04.1
linux-gcp-5.19All versions (No fix recorded)
linux-gcp-5.3All versions (No fix recorded)
linux-gcp-5.4< 5.4.0-1132.141~18.04.1
linux-gcp-5.8All versions (No fix recorded)
linux-gcp-6.2All versions (No fix recorded)
linux-gcp-6.5All versions (No fix recorded)
linux-gcp-fipsAll versions (No fix recorded) | < 5.4.0-1132.141+fips1 | < 5.15.0-1064.72+fips1
linux-gkeAll versions (No fix recorded) | < 5.15.0-1062.68 | < 6.8.0-1004.7
linux-gke-4.15All versions (No fix recorded)
linux-gke-5.15All versions (No fix recorded)
linux-gke-5.4All versions (No fix recorded)
linux-gkeop< 5.4.0-1095.99 | < 5.15.0-1048.55
linux-gkeop-5.15< 5.15.0-1048.55~20.04.1
linux-gkeop-5.4All versions (No fix recorded)
linux-hweAll versions (No fix recorded)
linux-hwe-5.11All versions (No fix recorded)
linux-hwe-5.13All versions (No fix recorded)
linux-hwe-5.15< 5.15.0-116.126~20.04.1
linux-hwe-5.19All versions (No fix recorded)
linux-hwe-5.4< 5.4.0-189.209~18.04.1
linux-hwe-5.8All versions (No fix recorded)
linux-hwe-6.2All versions (No fix recorded)
linux-hwe-6.5All versions (No fix recorded)
linux-hwe-edgeAll versions (No fix recorded)
linux-ibm< 5.4.0-1075.80 | < 5.15.0-1058.61 | < 6.8.0-1006.6
linux-ibm-5.15< 5.15.0-1058.61~20.04.1
linux-ibm-5.4< 5.4.0-1075.80~18.04.1
linux-intel-5.13All versions (No fix recorded)
linux-intel-iot-realtime< 5.15.0-1058.60
linux-intel-iotg< 5.15.0-1060.66
linux-intel-iotg-5.15< 5.15.0-1060.66~20.04.1
linux-iot< 5.4.0-1040.41
linux-kvmAll versions (No fix recorded) | < 5.4.0-1116.123 | < 5.15.0-1062.67
linux-lowlatency< 5.15.0-116.126 | < 6.8.0-35.35.1
linux-lowlatency-hwe-5.15< 5.15.0-116.126~20.04.1
linux-lowlatency-hwe-5.19All versions (No fix recorded)
linux-lowlatency-hwe-6.2All versions (No fix recorded)
linux-lowlatency-hwe-6.5All versions (No fix recorded)
linux-lts-xenialAll versions (No fix recorded)
linux-nvidia< 5.15.0-1060.61
linux-nvidia-6.2All versions (No fix recorded)
linux-nvidia-6.5All versions (No fix recorded)
linux-nvidia-tegra< 5.15.0-1026.26
linux-nvidia-tegra-5.15< 5.15.0-1027.27~20.04.1
linux-nvidia-tegra-igx< 5.15.0-1015.15
linux-oemAll versions (No fix recorded)
linux-oem-5.10All versions (No fix recorded)
linux-oem-5.13All versions (No fix recorded)
linux-oem-5.14All versions (No fix recorded)
linux-oem-5.17All versions (No fix recorded)
linux-oem-5.6All versions (No fix recorded)
linux-oem-6.0All versions (No fix recorded)
linux-oem-6.1All versions (No fix recorded)
linux-oem-6.5All versions (No fix recorded)
linux-oem-6.8< 6.8.0-1006.6
linux-oracleAll versions (No fix recorded) | < 5.4.0-1127.136 | < 5.15.0-1063.69 | < 6.8.0-1006.6
linux-oracle-5.0All versions (No fix recorded)
linux-oracle-5.11All versions (No fix recorded)
linux-oracle-5.13All versions (No fix recorded)
linux-oracle-5.15< 5.15.0-1063.69~20.04.1
linux-oracle-5.3All versions (No fix recorded)
linux-oracle-5.4< 5.4.0-1127.136~18.04.1
linux-oracle-5.8All versions (No fix recorded)
linux-oracle-6.5All versions (No fix recorded)
linux-raspi< 5.4.0-1112.124 | < 5.15.0-1058.61 | < 6.8.0-1005.5
linux-raspi-5.4< 5.4.0-1112.124~18.04.1
linux-raspi-realtime< 6.8.0-2004.4
linux-raspi2All versions (No fix recorded)
linux-realtimeAll versions (No fix recorded) | < 5.15.0-1066.74 | < 6.8.1-1002.2
linux-riscvAll versions (No fix recorded) | < 6.8.0-35.35.1
linux-riscv-5.11All versions (No fix recorded)
linux-riscv-5.15< 5.15.0-1061.65~20.04.1
linux-riscv-5.19All versions (No fix recorded)
linux-riscv-5.8All versions (No fix recorded)
linux-riscv-6.5All versions (No fix recorded)
linux-starfive-5.19All versions (No fix recorded)
linux-starfive-6.2All versions (No fix recorded)
linux-starfive-6.5All versions (No fix recorded)
linux-xilinx-zynqmp< 5.4.0-1047.51 | < 5.15.0-1035.39

Show all 118

Debian2 products

linux< 6.1.85-1 | < 6.7.12-1
debian_linuxEOL10.0

Linux2 products

linux≥ e28d2af43614eb86f59812e7221735fc221bbc10, < 7e500849fa558879a1cde43f80c7c048c2437058 | ≥ e28d2af43614eb86f59812e7221735fc221bbc10, < 9daddee03de3f231012014dab8ab2b277a116a55 | ≥ e28d2af43614eb86f59812e7221735fc221bbc10, < 6470078ab3d8f222115e11c4ec67351f3031b3dd | ≥ e28d2af43614eb86f59812e7221735fc221bbc10, < a55677878b93e9ebc31f66d0e2fb93be5e7836a6 | ≥ e28d2af43614eb86f59812e7221735fc221bbc10, < b7f6c3630eb3f103115ab0d7613588064f665d0d | ≥ e28d2af43614eb86f59812e7221735fc221bbc10, < a64ab862e84e3e698cd351a87cdb504c7fc575ca | ≥ e28d2af43614eb86f59812e7221735fc221bbc10, < befb7f889594d23e1b475720cf93efd2f77df000 | ≥ e28d2af43614eb86f59812e7221735fc221bbc10, < 394b6d8bbdf9ddee6d5bcf3e1f3e9f23eecd6484 | ≥ e28d2af43614eb86f59812e7221735fc221bbc10, < 50ed48c80fecbe17218afed4f8bed005c802976c | 4.10
linux_kernel< 4.19.312 | ≥ 4.20, < 5.4.274 | ≥ 5.5, < 5.10.215 | ≥ 5.11, < 5.15.154 | ≥ 5.16, < 6.1.84 | ≥ 6.2, < 6.6.24 | ≥ 6.7, < 6.7.12 | ≥ 6.8, < 6.8.3

3 vendors · 122 products

References

33 links

git.kernel.org/stable/c/7e500849fa558879a1cde43f80c7c048c2437058REPORTPatch
git.kernel.org/stable/c/9daddee03de3f231012014dab8ab2b277a116a55REPORTPatch
git.kernel.org/stable/c/6470078ab3d8f222115e11c4ec67351f3031b3ddREPORTPatch
git.kernel.org/stable/c/a55677878b93e9ebc31f66d0e2fb93be5e7836a6REPORTPatch
git.kernel.org/stable/c/b7f6c3630eb3f103115ab0d7613588064f665d0dREPORTPatch
git.kernel.org/stable/c/a64ab862e84e3e698cd351a87cdb504c7fc575caREPORTPatch
git.kernel.org/stable/c/befb7f889594d23e1b475720cf93efd2f77df000REPORTPatch
git.kernel.org/stable/c/394b6d8bbdf9ddee6d5bcf3e1f3e9f23eecd6484REPORTPatch
git.kernel.org/stable/c/50ed48c80fecbe17218afed4f8bed005c802976cREPORTPatch
lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlX TransferredMailing ListThird Party Advisory

Show all 33 references

ubuntu.com/security/CVE-2024-26957REPORT
www.cve.org/CVERecord?id=CVE-2024-26957REPORT
git.kernel.org/linus/50ed48c80fecbe17218afed4f8bed005c802976cREPORT
ubuntu.com/security/notices/USN-6816-1Advisory
ubuntu.com/security/notices/USN-6817-1Advisory
ubuntu.com/security/notices/USN-6817-2Advisory
ubuntu.com/security/notices/USN-6817-3Advisory
ubuntu.com/security/notices/USN-6878-1Advisory
ubuntu.com/security/notices/USN-6896-1Advisory
ubuntu.com/security/notices/USN-6898-1Advisory
ubuntu.com/security/notices/USN-6896-2Advisory
ubuntu.com/security/notices/USN-6898-2Advisory
ubuntu.com/security/notices/USN-6896-3Advisory
ubuntu.com/security/notices/USN-6898-3Advisory
ubuntu.com/security/notices/USN-6896-4Advisory
ubuntu.com/security/notices/USN-6896-5Advisory
ubuntu.com/security/notices/USN-6898-4Advisory
ubuntu.com/security/notices/USN-6917-1Advisory
ubuntu.com/security/notices/USN-6919-1Advisory
ubuntu.com/security/notices/USN-6927-1Advisory
ubuntu.com/security/notices/USN-7019-1Advisory
security-tracker.debian.org/tracker/CVE-2024-26957Advisory
cert-portal.siemens.com/productcert/html/ssa-398330.html

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities