What is CVE-2024-26833?

CVE-2024-26833 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10, classified as a Memory Leak flaw (CWE-401). CVE-2024-26833 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2024-26833?

CVE-2024-26833 has a CVSS score of 5.5 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2024-26833?

No patch is currently available for CVE-2024-26833. Monitor the NIST NVD and your Linux distribution's security advisories for updates.

Is CVE-2024-26833 actively exploited?

CVE-2024-26833 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is Memory Leak (CWE-401)?

The product does not release memory after use, causing gradual resource exhaustion. See MITRE CWE for full details: https://cwe.mitre.org/data/definitions/401.html

CVE-2024-26833

Medium

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix memory leak in dm_sw_fini() After destroying dmub_srv, the memory associated with it is not freed, causing a memory leak: unreferenced object 0xffff896302b45800 (size 1024): comm "(udev-worker)", pid 222, jiffies 4294894636 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 6265fd77): [<ffffffff993495ed>] kmalloc_trace+0x29d/0x340 [<ffffffffc0ea4a94>] dm_dmub_sw_init+0xb4/0x450 [amdgpu] [<ffffffffc0ea4e55>] dm_sw_init+0x15/0x2b0 [amdgpu] [<ffffffffc0ba8557>] amdgpu_device_init+0x1417/0x24e0 [amdgpu] [<ffffffffc0bab285>] amdgpu_driver_load_kms+0x15/0x190 [amdgpu] [<ffffffffc0ba09c7>] amdgpu_pci_probe+0x187/0x4e0 [amdgpu] [<ffffffff9968fd1e>] local_pci_probe+0x3e/0x90 [<ffffffff996918a3>] pci_device_probe+0xc3/0x230 [<ffffffff99805872>] really_probe+0xe2/0x480 [<ffffffff99805c98>] __driver_probe_device+0x78/0x160 [<ffffffff99805daf>] driver_probe_device+0x1f/0x90 [<ffffffff9980601e>] __driver_attach+0xce/0x1c0 [<ffffffff99803170>] bus_for_each_dev+0x70/0xc0 [<ffffffff99804822>] bus_add_driver+0x112/0x210 [<ffffffff99807245>] driver_register+0x55/0x100 [<ffffffff990012d1>] do_one_initcall+0x41/0x300 Fix this by freeing dmub_srv after destroying it.

Package Linux Kernel

Published 2024-04-17

Last modified 2025-01-07

CVSS version 3.1

Patch available

Awaiting data

CVSS 3.1 score

5.5

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness type

CWE-401

CVE-2024-26833 is a Memory Leak vulnerability

What is Memory Leak?

The product does not release memory after use, causing gradual resource exhaustion. Learn more on MITRE CWE

References

The following references provide additional information about CVE-2024-26833 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.

Kernel patch commit
https://git.kernel.org/stable/c/10c6b90e975358c17856a578419dc449887899c2
Patch
Kernel patch commit
https://git.kernel.org/stable/c/33f649f1b1cea39ed360e6c12bba4fac83118e6e
Patch
Kernel patch commit
https://git.kernel.org/stable/c/541e79265ea7e339a7c4a462feafe9f8f996e04b
Patch

7 patch commits total View all on NVD

Details

CVE ID CVE-2024-26833

Severity Medium

CVSS score 5.5 / 10

CVSS version 3.1

Published 2024-04-17

Modified 2025-01-07

KEV No

Patch Awaiting data

Package linux

Frequently asked questions

What is CVE-2024-26833?

CVE-2024-26833 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 , classified as a Memory Leak flaw (CWE-401) . CVE-2024-26833 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2024-26833?

CVE-2024-26833 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2024-26833?

No patch is currently available for CVE-2024-26833. Monitor the NIST NVD and your Linux distribution's security advisories for updates.
Is CVE-2024-26833 actively exploited?

No — CVE-2024-26833 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
What is Memory Leak (CWE-401)?

The product does not release memory after use, causing gradual resource exhaustion. View CWE-401 on MITRE CWE →