Kernel Panic Vulnerability in Linux Package: CVE-2024-26902
Summary
DEBIAN-CVE-2024-26902: In the Linux kernel, the following vulnerability has been resolved: perf: RISCV: Fix panic on pmu overflow handler (1. Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It is known for its stability, performance, and extensive support for various hardware architectures. However, like any complex software, it can be susceptible to vulnerabilities that may compromise system integrity and performance.
Vulnerability Detail
CVE-2024-26902 is a vulnerability in the Linux kernel that arises from a flaw in the performance monitoring unit (PMU) overflow handler for the RISC-V architecture. Specifically, the issue occurs when the kernel attempts to set bits in an unsigned long variable, leading to a kernel panic when executing the 'perf record -e branches' command on specific hardware (Sophgo sg2042). This results in a NULL pointer dereference, causing the system to crash and potentially leading to data loss or system unavailability.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
CVE-2024-26902 is a critical vulnerability in the Linux kernel that can lead to severe system instability. Users are advised to update their Linux package to the latest patched version to mitigate risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2024-26902 is a vulnerability in the Linux kernel that can cause a kernel panic due to a flaw in the PMU overflow handler.
This vulnerability can lead to system crashes and data loss when executing specific performance monitoring commands.
If you are using the affected versions of the Linux package on Debian 13 or 14, your system may be vulnerable. You can check your application using Vulert.
The best way to protect your system is to update the Linux package to the patched version 6.7.12-1 or later.
Vulert monitors and alerts for open-source vulnerabilities in software using a manifest file. You can check if your application is affected by this vulnerability using the Vulert playground without signing up.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
