CVE-2024-26791 json
btrfs: dev-replace: properly validate device names
published 2y ago modified 4mo ago also EUVD-2024-24053
- cvss
- 7.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 16%
- public exploits
- 0
- none known
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: dev-replace: properly validate device names
There's a syzbot report that device name buffers passed to device replace are not properly checked for string termination which could lead to a read out of bounds in getname_kernel().
Add a helper that validates both source and target device name buffers. For devid as the source initialize the buffer to empty string in case something tries to read it later.
This was originally analyzed and fixed in a different way by Edward Adam Davis (see links).
Patch / fix
- Linux Linux 4.19.309, 5.4.271, 5.10.212, 5.15.151, 6.1.81, 6.6.21, 6.7.9, 6.8
- linux Debian 12 6.1.82-1
- linux Debian 14, Debian 13 6.7.9-1
debian advisories DEBIAN-CVE-2024-26791
- linux Ubuntu 20.04 LTS 5.4.0-186.206
- linux Ubuntu 22.04 LTS 5.15.0-112.122
- linux-aws Ubuntu 20.04 LTS 5.4.0-1126.136
- linux-aws Ubuntu 22.04 LTS 5.15.0-1063.69
- linux-gcp Ubuntu 20.04 LTS 5.4.0-1130.139
- linux-gcp Ubuntu 22.04 LTS 5.15.0-1062.70
- linux-gke Ubuntu 22.04 LTS 5.15.0-1060.66
- linux-ibm Ubuntu 20.04 LTS 5.4.0-1073.78
ubuntu advisories UBUNTU-CVE-2024-26791
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- kernel-rt Linux Micro 6.0 6.4.0-9.1
- kernel-source-rt Linux Micro 6.0 6.4.0-9.1
- kernel-source Linux Micro 6.0 6.4.0-18.1
- kernel-default Linux Micro 6.0 6.4.0-18.1
- kernel-kvmsmall Linux Micro 6.0 6.4.0-18.1
- kernel-default-base Linux Micro 6.0 6.4.0-17.1.1.51
- kernel-rt Real Time Module 15 SP6, openSUSE Leap 15.6 6.4.0-150600.10.5.1
- kernel-syms-rt Real Time Module 15 SP6, openSUSE Leap 15.6 6.4.0-150600.10.5.1
suse advisories SUSE-SU-2025:20028-1SUSE-SU-2025:20008-1SUSE-SU-2024:2973-1SUSE-SU-2024:2203-1SUSE-SU-2024:2190-1SUSE-SU-2024:2184-1
- git.kernel.org/stable/c/11d7a2e429c02d51e2dc90713823ea8b8d3d3a84 commit
- git.kernel.org/stable/c/c6652e20d7d783d060fe5f987eac7b5cabe31311 commit
- git.kernel.org/stable/c/2886fe308a83968dde252302884a1e63351cf16d commit
- git.kernel.org/stable/c/ab2d68655d0f04650bef09fee948ff80597c5fb9 commit
- git.kernel.org/stable/c/f590040ce2b712177306b03c2a63b16f7d48d3c8 commit
- git.kernel.org/stable/c/b1690ced4d2d8b28868811fb81cd33eee5aefee1 commit
- git.kernel.org/stable/c/343eecb4ff49a7b1cc1dfe86958a805cf2341cfb commit
- git.kernel.org/stable/c/9845664b9ee47ce7ee7ea93caf47d39a9d4552c4 commit
- lists.debian.org/debian-lts-announce/2024/06/msg00017.html patch
- lists.debian.org/debian-lts-announce/2024/06/msg00020.html patch
Is CVE-2024-26791 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-26791 updated cvss 5.5
kernel: btrfs: dev-replace: properly validate device names
-
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 moreaffected: workaround, no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-25-226-15 updated
Siemens SINEC OS
-
Siemens RUGGEDCOM RST2428P (6GK6242-6PA00) Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 familynot affected
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2y ago
Exploit prediction
0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Affected products
- Linux Linux
Classification
- Weakness
-
- CWE-125 Out-of-bounds Read
- Technology feeds
References
-
git.kernel.org
/stable/c/11d7a2e429c02d51e2dc90713823ea8b8d3d3a84
patch
-
git.kernel.org
/stable/c/c6652e20d7d783d060fe5f987eac7b5cabe31311
patch
-
git.kernel.org
/stable/c/2886fe308a83968dde252302884a1e63351cf16d
patch
-
git.kernel.org
/stable/c/ab2d68655d0f04650bef09fee948ff80597c5fb9
patch
-
git.kernel.org
/stable/c/f590040ce2b712177306b03c2a63b16f7d48d3c8
patch
-
git.kernel.org
/stable/c/b1690ced4d2d8b28868811fb81cd33eee5aefee1
patch
-
git.kernel.org
/stable/c/343eecb4ff49a7b1cc1dfe86958a805cf2341cfb
patch
-
git.kernel.org
/stable/c/9845664b9ee47ce7ee7ea93caf47d39a9d4552c4
patch
-
lists.debian.org
/debian-lts-announce/2024/06/msg00017.html
patch
-
lists.debian.org
/debian-lts-announce/2024/06/msg00020.html
patch
Sources
- CVE List CVE-2024-26791
- NVD CVE-2024-26791
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.