{"id":"CVE-2024-26870","revision":"a1a2726692fe465d91d32d9f446b5f66","records":[{"revision":"a1a2726692fe465d91d32d9f446b5f66","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-26870","aliases":[],"title":"NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102\n\nA call to listxattr() with a buffer size = 0 returns the actual\nsize of the buffer needed for a subsequent call. When size > 0,\nnfs4_listxattr() does not return an error because either\ngeneric_listxattr() or nfs4_listxattr_nfs4_label() consumes\nexactly all the bytes then size is 0 when calling\nnfs4_listxattr_nfs4_user() which then triggers the following\nkernel BUG:\n\n [ 99.403778] kernel BUG at mm/usercopy.c:102!\n [ 99.404063] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP\n [ 99.408463] CPU: 0 PID: 3310 Comm: python3 Not tainted 6.6.0-61.fc40.aarch64 #1\n [ 99.415827] Call trace:\n [ 99.415985] usercopy_abort+0x70/0xa0\n [ 99.416227] __check_heap_object+0x134/0x158\n [ 99.416505] check_heap_object+0x150/0x188\n [ 99.416696] __check_object_size.part.0+0x78/0x168\n [ 99.416886] __check_object_size+0x28/0x40\n [ 99.417078] listxattr+0x8c/0x120\n [ 99.417252] path_listxattr+0x78/0xe0\n [ 99.417476] __arm64_sys_listxattr+0x28/0x40\n [ 99.417723] invoke_syscall+0x78/0x100\n [ 99.417929] el0_svc_common.constprop.0+0x48/0xf0\n [ 99.418186] do_el0_svc+0x24/0x38\n [ 99.418376] el0_svc+0x3c/0x110\n [ 99.418554] el0t_64_sync_handler+0x120/0x130\n [ 99.418788] el0t_64_sync+0x194/0x198\n [ 99.418994] Code: aa0003e3 d000a3e0 91310000 97f49bdb (d4210000)\n\nIssue is reproduced when generic_listxattr() returns 'system.nfs4_acl',\nthus calling lisxattr() with size = 16 will trigger the bug.\n\nAdd check on nfs4_listxattr() to return ERANGE error when it is\ncalled with size > 0 and the return value is greater than size.","state":0,"publishedAt":"2024-04-17T10:27:30.756+00:00","modifiedAt":"2026-10-15T00:38:55.474+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"fs/nfs/nfs4proc.c\"\n ],\n \"versions\": [\n {\n \"version\": \"012a211abd5db098094ce429de5f046368391e68\",\n \"lessThan\": \"4403438eaca6e91f02d272211c4d6b045092396b\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"012a211abd5db098094ce429de5f046368391e68\",\n \"lessThan\": \"9d52865ff28245fc2134da9f99baff603a24407a\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"012a211abd5db098094ce429de5f046368391e68\",\n \"lessThan\": \"06e828b3f1b206de08ef520fc46a40b22e1869cb\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"012a211abd5db098094ce429de5f046368391e68\",\n \"lessThan\": \"79cdcc765969d23f4e3d6ea115660c3333498768\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"012a211abd5db098094ce429de5f046368391e68\",\n \"lessThan\": \"80365c9f96015bbf048fdd6c8705d3f8770132bf\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"012a211abd5db098094ce429de5f046368391e68\",\n \"lessThan\": \"23bfecb4d852751d5e403557dd500bb563313baf\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"012a211abd5db098094ce429de5f046368391e68\",\n \"lessThan\": \"251a658bbfceafb4d58c76b77682c8bf7bcfad65\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"fs/nfs/nfs4proc.c\"\n ],\n \"versions\": [\n {\n \"version\": \"5.9\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"5.9\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.10.214\",\n \"lessThanOrEqual\": \"5.10.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.153\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.83\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.23\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.7.11\",\n \"lessThanOrEqual\": \"6.7.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.8.2\",\n \"lessThanOrEqual\": \"6.8.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.9\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/4403438eaca6e91f02d272211c4d6b045092396b","https://git.kernel.org/stable/c/9d52865ff28245fc2134da9f99baff603a24407a","https://git.kernel.org/stable/c/06e828b3f1b206de08ef520fc46a40b22e1869cb","https://git.kernel.org/stable/c/79cdcc765969d23f4e3d6ea115660c3333498768","https://git.kernel.org/stable/c/80365c9f96015bbf048fdd6c8705d3f8770132bf","https://git.kernel.org/stable/c/23bfecb4d852751d5e403557dd500bb563313baf","https://git.kernel.org/stable/c/251a658bbfceafb4d58c76b77682c8bf7bcfad65"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-26870","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-26870","identifiers":["CVE-2024-26870"]},"retained":false,"historicalAffected":[]}],"coverage":[]}