{"id":"CVE-2024-26870","revision":null,"records":[{"revision":"a1a2726692fe465d91d32d9f446b5f66","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-26870","aliases":[],"title":"NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102\n\nA call to listxattr() with a buffer size = 0 returns the actual\nsize of the buffer needed for a subsequent call. When size > 0,\nnfs4_listxattr() does not return an error because either\ngeneric_listxattr() or nfs4_listxattr_nfs4_label() consumes\nexactly all the bytes then size is 0 when calling\nnfs4_listxattr_nfs4_user() which then triggers the following\nkernel BUG:\n\n  [   99.403778] kernel BUG at mm/usercopy.c:102!\n  [   99.404063] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP\n  [   99.408463] CPU: 0 PID: 3310 Comm: python3 Not tainted 6.6.0-61.fc40.aarch64 #1\n  [   99.415827] Call trace:\n  [   99.415985]  usercopy_abort+0x70/0xa0\n  [   99.416227]  __check_heap_object+0x134/0x158\n  [   99.416505]  check_heap_object+0x150/0x188\n  [   99.416696]  __check_object_size.part.0+0x78/0x168\n  [   99.416886]  __check_object_size+0x28/0x40\n  [   99.417078]  listxattr+0x8c/0x120\n  [   99.417252]  path_listxattr+0x78/0xe0\n  [   99.417476]  __arm64_sys_listxattr+0x28/0x40\n  [   99.417723]  invoke_syscall+0x78/0x100\n  [   99.417929]  el0_svc_common.constprop.0+0x48/0xf0\n  [   99.418186]  do_el0_svc+0x24/0x38\n  [   99.418376]  el0_svc+0x3c/0x110\n  [   99.418554]  el0t_64_sync_handler+0x120/0x130\n  [   99.418788]  el0t_64_sync+0x194/0x198\n  [   99.418994] Code: aa0003e3 d000a3e0 91310000 97f49bdb (d4210000)\n\nIssue is reproduced when generic_listxattr() returns 'system.nfs4_acl',\nthus calling lisxattr() with size = 16 will trigger the bug.\n\nAdd check on nfs4_listxattr() to return ERANGE error when it is\ncalled with size > 0 and the return value is greater than size.","state":0,"publishedAt":"2024-04-17T10:27:30.756+00:00","modifiedAt":"2026-10-15T00:38:55.474+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/nfs/nfs4proc.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"012a211abd5db098094ce429de5f046368391e68\",\n                            \"lessThan\": \"4403438eaca6e91f02d272211c4d6b045092396b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"012a211abd5db098094ce429de5f046368391e68\",\n                            \"lessThan\": \"9d52865ff28245fc2134da9f99baff603a24407a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"012a211abd5db098094ce429de5f046368391e68\",\n                            \"lessThan\": \"06e828b3f1b206de08ef520fc46a40b22e1869cb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"012a211abd5db098094ce429de5f046368391e68\",\n                            \"lessThan\": \"79cdcc765969d23f4e3d6ea115660c3333498768\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"012a211abd5db098094ce429de5f046368391e68\",\n                            \"lessThan\": \"80365c9f96015bbf048fdd6c8705d3f8770132bf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"012a211abd5db098094ce429de5f046368391e68\",\n                            \"lessThan\": \"23bfecb4d852751d5e403557dd500bb563313baf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"012a211abd5db098094ce429de5f046368391e68\",\n                            \"lessThan\": \"251a658bbfceafb4d58c76b77682c8bf7bcfad65\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/nfs/nfs4proc.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.9\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.214\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.153\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.83\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.23\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.7.11\",\n                            \"lessThanOrEqual\": \"6.7.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.8.2\",\n                            \"lessThanOrEqual\": \"6.8.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.9\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/4403438eaca6e91f02d272211c4d6b045092396b","https://git.kernel.org/stable/c/9d52865ff28245fc2134da9f99baff603a24407a","https://git.kernel.org/stable/c/06e828b3f1b206de08ef520fc46a40b22e1869cb","https://git.kernel.org/stable/c/79cdcc765969d23f4e3d6ea115660c3333498768","https://git.kernel.org/stable/c/80365c9f96015bbf048fdd6c8705d3f8770132bf","https://git.kernel.org/stable/c/23bfecb4d852751d5e403557dd500bb563313baf","https://git.kernel.org/stable/c/251a658bbfceafb4d58c76b77682c8bf7bcfad65"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-26870","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-26870","identifiers":["CVE-2024-26870"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T21:04:24.7578035+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-09T21:04:24.7578035+00:00","lastSuccessAt":"2026-11-09T21:04:24.9268553+00:00","error":null,"lastVerifiedAt":"2026-11-09T21:04:24.9268558+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-496c6c80845a4235d695039f4a651d70f3b55bc53fc01f5ca259c734136db852","complete":true,"records":421688,"lastAttemptAt":"2026-11-09T22:02:15.6116354+00:00","lastSuccessAt":"2026-11-09T22:02:15.4777453+00:00","error":null,"lastVerifiedAt":"2026-11-09T22:02:15.6116354+00:00","snapshotPublishedAt":"2026-11-09T21:30:28+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c0d08c6d568c485b97f7477173a8f37a","complete":false,"records":13661,"lastAttemptAt":"2026-11-09T21:17:08.552025+00:00","lastSuccessAt":"2026-11-09T21:17:08.543+00:00","error":"19 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-09T21:17:08.543+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13205,"expectedIdentifiers":13714,"failedIdentifiers":19},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T21:04:24.7578035+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T21:04:24.7578035+00:00","lastSuccessAt":"2026-11-09T21:04:28.0976125+00:00","error":null,"lastVerifiedAt":"2026-11-09T21:04:28.0976126+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-0bbee8bbb4ab420e9cc5a178c14c3d7c","complete":false,"records":13673,"lastAttemptAt":"2026-11-09T21:04:53.6647083+00:00","lastSuccessAt":"2026-11-09T21:04:53.656+00:00","error":null,"lastVerifiedAt":"2026-11-09T21:04:53.656+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13704,"expectedIdentifiers":13714,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-f3867a42f9521b26d30bf45a82113d9245ec430c8ce8e24ac384524aacc94234","complete":true,"records":9916,"lastAttemptAt":"2026-11-09T21:04:24.6555906+00:00","lastSuccessAt":"2026-11-09T21:04:24.2243141+00:00","error":null,"lastVerifiedAt":"2026-11-09T21:04:24.6555906+00:00","snapshotPublishedAt":"2026-11-09T21:03:14+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T22:02:15.7662034+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-09T22:02:15.7662034+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-761ecc9061239b0da572dc9254c6f384c1d19339eb08408c436647a2f26129e9","complete":true,"records":3064,"lastAttemptAt":"2026-11-09T21:04:24.720759+00:00","lastSuccessAt":"2026-11-09T17:05:03.4044794+00:00","error":null,"lastVerifiedAt":"2026-11-09T21:04:24.720759+00:00","snapshotPublishedAt":"2026-11-09T16:33:20+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-2e8b7295933e7bde85a0f6f5814c210f0d64871f05755388951863da683dd321","complete":true,"records":231324,"lastAttemptAt":"2026-11-09T22:02:23.3040148+00:00","lastSuccessAt":"2026-11-09T21:04:13.103121+00:00","error":null,"lastVerifiedAt":"2026-11-09T21:04:14.5816688+00:00","snapshotPublishedAt":"2026-11-09T20:48:07+00:00","importing":true,"stagedRecords":184000,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}