What is CVE-2024-26697?

CVE-2024-26697 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10, classified as a Out-of-bounds Write flaw (CWE-787), affecting Linux kernel versions from 2.6.30 onward and patched in 4.19.307, 5.4.269, 5.10.210 and others. CVE-2024-26697 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2024-26697?

CVE-2024-26697 has a CVSS score of 5.5 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2024-26697?

Yes, CVE-2024-26697 has been patched. Fixed versions include 4.19.307, 5.4.269, 5.10.210 and others. If you are running Linux kernel 2.6.30 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2024-26697 actively exploited?

CVE-2024-26697 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is Out-of-bounds Write (CWE-787)?

The product writes data past the end or before the beginning of the intended buffer. See MITRE CWE for full details: https://cwe.mitre.org/data/definitions/787.html

CVE-2024-26697

Medium

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix data corruption in dsync block recovery for small block sizes The helper function nilfs_recovery_copy_block() of nilfs_recovery_dsync_blocks(), which recovers data from logs created by data sync writes during a mount after an unclean shutdown, incorrectly calculates the on-page offset when copying repair data to the file's page cache. In environments where the block size is smaller than the page size, this flaw can cause data corruption and leak uninitialized memory bytes during the recovery process. Fix these issues by correcting this byte offset calculation on the page.

Package Linux Kernel

Published 2024-04-03

Last modified 2025-03-17

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

5.5

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness type

CWE-787

CVE-2024-26697 is a Out-of-bounds Write vulnerability

What is Out-of-bounds Write?

The product writes data past the end or before the beginning of the intended buffer. Learn more on MITRE CWE

Affected versions

Linux kernel versions 2.6.30 and later are affected. Fixed in 4.19.307, 5.4.269, 5.10.210, 5.15.149, 6.1.79, 6.6.18, 6.7.6, 6.8 and their respective stable series.

Affected from

≥ 2.6.30

Fixed in

✓ 4.19.307 4.19.x ✓ 5.4.269 5.4.x ✓ 5.10.210 5.10.x ✓ 5.15.149 5.15.x ✓ 6.1.79 6.1.x ✓ 6.6.18 6.6.x ✓ 6.7.6 6.7.x ✓ 6.8

References

10 total

Kernel Git
https://git.kernel.org/stable/c/120f7fa2008e3bd8b7680b4ab5df942decf60fd5

Patch
Kernel Git
https://git.kernel.org/stable/c/2000016bab499074e6248ea85aeea7dd762355d9

Patch
Kernel Git
https://git.kernel.org/stable/c/2e1480538ef60bfee5473dfe02b1ecbaf1a4aa0d

Patch
Kernel Git
https://git.kernel.org/stable/c/364a66be2abdcd4fd426ffa44d9b8f40aafb3caa

Patch
Kernel Git
https://git.kernel.org/stable/c/5278c3eb6bf5896417572b52adb6be9d26e92f65

Patch

Showing 5 of 10 references View all on NVD

Details

CVE ID CVE-2024-26697

Severity Medium

CVSS score 5.5 / 10

CVSS version 3.1

Published 2024-04-03

Modified 2025-03-17

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2024-26697?

CVE-2024-26697 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 , classified as an Out-of-bounds Write flaw (CWE-787) . It affects Linux kernel versions from 2.6.30 onward and has been patched in 4.19.307, 5.4.269, 5.10.210 and others. CVE-2024-26697 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2024-26697?

CVE-2024-26697 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2024-26697?

Yes. CVE-2024-26697 has been patched. Fixed versions include 4.19.307, 5.4.269, 5.10.210 and others. If you are running Linux kernel 2.6.30 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2024-26697 actively exploited?

No. CVE-2024-26697 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.