CVE-2024-26766: IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
Noroxi assessment
Priority: Monitor (action score 22/100)
- The sources we track (CISA KEV, Exploit-DB, Metasploit, Nuclei, GitHub) show no public exploit code or exploitation in the wild.
- Probability of exploitation in the next 30 days: 0.26% (FIRST EPSS).
- Someone with local access to the system can trigger it. A low-privileged account is enough. No user action is required. No special conditions are required; it is repeatable.
- Fixed version: Linux Linux 115b7f3bc1dce590a6851a2dcf23dc1100c49790, 3f38d22e645e2e994979426ea5a35186102ff3c2, 4.19.308.
- Severity is disputed: the assigning authority (CNA) scores it 7.8, NVD 5.5.
- Mentioned 2 times in Turkish national cyber security advisories (siberguvenlik.gov.tr).
Low priority for now. Upgrade to Linux Linux 115b7f3bc1dce590a6851a2dcf23dc1100c49790, 3f38d22e645e2e994979426ea5a35186102ff3c2, 4.19.308 or later.
Generated automatically from the record's data: CVSS (NVD and CNA), CISA KEV and SSVC, FIRST EPSS, exploit sources, fixed versions. How we calculate it
Primary sources: NVD · CVE.org · FIRST EPSS
In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix sdma.h tx->num_descs off-by-one error Unfortunately the commit `fd8958efe877` introduced another error causing the `descs` array to overflow. This reults in further crashes easily reproducible by `sendmsg` system call. [ 1080.836473] general protection fault, probably for non-canonical address 0x400300015528b00a: 0000 [#1] PREEMPT SMP PTI [ 1080.869326] RIP: 0010:hfi1_ipoib_build_ib_tx_headers.constprop.0+0xe1/0x2b0 [hfi1] -- [ 1080.974535] Call Trace: [ 1080.976990] <TASK> [ 1081.021929] hfi1_ipoib_send_dma_common+0x7a/0x2e0 [hfi1] [ 1081.027364] hfi1_ipoib_send_dma_list+0x62/0x270 [hfi1] [ 1081.032633] hfi1_ipoib_send+0x112/0x300 [hfi1] [ 1081.042001] ipoib_start_xmit+0x2a9/0x2d0 [ib_ipoib] [ 1081.046978] dev_hard_start_xmit+0xc4/0x210 -- [ 1081.148347] __sys_sendmsg+0x59/0xa0 crash> ipoib_txreq 0xffff9cfeba229f00 struct ipoib_txreq { txreq = { list = { next = 0xffff9cfeba229f00, prev = 0xffff9cfeba229f00 }, descp = 0xffff9cfeba229f40, coalesce_buf = 0x0, wait = 0xffff9cfea4e69a48, complete = 0xffffffffc0fe0760 <hfi1_ipoib_sdma_complete>, packet_len = 0x46d, tlen = 0x0, num_desc = 0x0, desc_limit = 0x6, next_descq_idx = 0x45c, coalesce_idx = 0x0, flags = 0x0, descs = {{ qw = {0x8024000120dffb00, 0x4} # SDMA_DESC0_FIRST_DESC_FLAG (bit 63) }, { qw = { 0x3800014231b108, 0x4} }, { qw = { 0x310000e4ee0fcf0, 0x8} }, { qw = { 0x3000012e9f8000, 0x8} }, { qw = { 0x59000dfb9d0000, 0x8} }, { qw = { 0x78000e02e40000, 0x8} }} }, sdma_hdr = 0x400300015528b000, <<< invalid pointer in the tx request structure sdma_status = 0x0, SDMA_DESC0_LAST_DESC_FLAG (bit 62) complete = 0x0, priv = 0x0, txq = 0xffff9cfea4e69880, skb = 0xffff9d099809f400 } If an SDMA send consists of exactly 6 descriptors and requires dword padding (in the 7th descriptor), the sdma_txreq descriptor array is not properly expanded and the packet will overflow into the container structure. This results in a panic when the send completion runs. The exact panic varies depending on what elements of the container structure get corrupted. The fix is to use the correct expression in _pad_sdma_tx_descs() to test the need to expand the descriptor array. With this patch the crashes are no longer reproducible and the machine is stable.
- BDU:2024-08661
- ALSA-2026:1661
- ALSA-2026:1662
- RHSA-2026:1661
- RHSA-2026:1662
- RLSA-2026:1661
- RLSA-2026:1662
- SUSE-SU-2024:1677-1
- SUSE-SU-2024:1679-1
- SUSE-SU-2024:1680-1
- SUSE-SU-2024:1682-1
- SUSE-SU-2024:1685-1
- SUSE-SU-2024:1695-1
- SUSE-SU-2024:1705-1
- SUSE-SU-2024:1711-1
- SUSE-SU-2024:1726-1
- SUSE-SU-2024:1739-1
- SUSE-SU-2024:1740-1
- SUSE-SU-2024:1748-1
- SUSE-SU-2024:1749-1
- Published
- Apr 3, 2024
- Updated
- Aug 5, 2026
- EPSS
- 0.2% · 19th percentile
- CWE
- CWE-193
Report tools
Action score
22
Monitor
Low priority for now.
- CVSS
- 22 / 40 · 5.5 / 10
- CISA KEV
- 0 / 30 · Not listed
- EPSS
- 0 / 30 · 0.2%
CISA SSVC decision
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
Vulnrichment: CISA's decision-tree inputs.
CNA vs NVD score
- NVD
- 5.5
- CNA · Linux
- 7.8
- 2.3 point gap
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The score given by the assigning authority versus NVD’s independent score. A gap means the severity is contested.
Get told when this record changes
- Not in KEV: no record of exploitation in the wild
- No public exploit code on record
- A fix has been released
If any of these changes, we'll tell you in the daily email digest.
Running WordPress? Scan your site free with WP Lens
Noroxi analysis
What does it mean in your environment?
The assessment above is generated automatically from the record's data; it doesn't know your environment. Our team verifies on your systems whether this vulnerability is actually exploitable and which mitigation is enough.
We use this product, ask for helpAffected systems
Is your version affected?
Pick the product and type the version you run. It's compared with this record's version ranges in your browser; the version isn't sent anywhere.
| Vendor | Product | CPE |
|---|---|---|
| linux | linux kernel | cpe:2.3:o:linux:linux_kernel |
| debian | debian linux | cpe:2.3:o:debian:debian_linux |
Affected versions
NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.
- debian debian linux10.0
- linux linux kernel5.4.251 and later · before 5.4.270
- linux linux kernel5.10.188 and later · before 5.10.211
- linux linux kernel5.15.99 and later · before 5.15.150
- linux linux kernel4.19.291 and later · before 4.19.308
- linux linux kernel6.2.3 and later · before 6.6.19
- linux linux kernel6.7 and later · before 6.7.7
- linux linux kernel6.1.16 and later · before 6.1.80
- linux linux kernel6.8
Versions reported by the vendor
Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.
Linux Linux
- 0ef9594936d1f078e8599a1cf683b052df2bec00, 6.3affected
- d1c1ee052d25ca23735eea912f843bc7834781b4 and later · before 115b7f3bc1dce590a6851a2dcf23dc1100c49790affected · git
- 40ac5cb6cbb01afa40881f78b4d2f559fb7065c4 and later · before 5833024a9856f454a964a198c63a57e59e07baf5affected · git
- 6cf8f3d690bb5ad31ef0f41a6206ecf5a068d179 and later · before 3f38d22e645e2e994979426ea5a35186102ff3c2affected · git
- bd57756a7e43c7127d0eca1fc5868e705fd0f7ba and later · before 47ae64df23ed1318e27bd9844e135a5e1c0e6e39affected · git
- eeaf35f4e3b360162081de5e744cf32d6d1b0091 and later · before 52dc9a7a573dbf778625a0efca0fca55489f084baffected · git
- fd8958efe8779d3db19c9124fce593ce681ac709 and later · before a2fef1d81becf4ff60e1a249477464eae3c3bc2aaffected · git
- fd8958efe8779d3db19c9124fce593ce681ac709 and later · before 9034a1bec35e9f725315a3bb6002ef39666114d9affected · git
- fd8958efe8779d3db19c9124fce593ce681ac709 and later · before e6f57c6881916df39db7d95981a8ad2b9c3458d6affected · git
- 4.19.291 and later · before 4.19.308affected · semver
Package-level exposure
OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.
| Ecosystem | Package | Affected range | Fix |
|---|---|---|---|
| AlmaLinux:8 | bpftool | before 4.18.0-553.100.1.el8_10 | 4.18.0-553.100.1.el8_10 |
| AlmaLinux:8 | kernel | before 4.18.0-553.100.1.el8_10 | 4.18.0-553.100.1.el8_10 |
| AlmaLinux:8 | kernel-abi-stablelists | before 4.18.0-553.100.1.el8_10 | 4.18.0-553.100.1.el8_10 |
| AlmaLinux:8 | kernel-core | before 4.18.0-553.100.1.el8_10 | 4.18.0-553.100.1.el8_10 |
| AlmaLinux:8 | kernel-cross-headers | before 4.18.0-553.100.1.el8_10 | 4.18.0-553.100.1.el8_10 |
| AlmaLinux:8 | kernel-debug | before 4.18.0-553.100.1.el8_10 | 4.18.0-553.100.1.el8_10 |
| AlmaLinux:8 | kernel-debug-core | before 4.18.0-553.100.1.el8_10 | 4.18.0-553.100.1.el8_10 |
| AlmaLinux:8 | kernel-debug-devel | before 4.18.0-553.100.1.el8_10 | 4.18.0-553.100.1.el8_10 |
| AlmaLinux:8 | kernel-debug-modules | before 4.18.0-553.100.1.el8_10 | 4.18.0-553.100.1.el8_10 |
| AlmaLinux:8 | kernel-debug-modules-extra | before 4.18.0-553.100.1.el8_10 | 4.18.0-553.100.1.el8_10 |
| AlmaLinux:8 | kernel-devel | before 4.18.0-553.100.1.el8_10 | 4.18.0-553.100.1.el8_10 |
| AlmaLinux:8 | kernel-doc | before 4.18.0-553.100.1.el8_10 | 4.18.0-553.100.1.el8_10 |
| AlmaLinux:8 | kernel-headers | before 4.18.0-553.100.1.el8_10 | 4.18.0-553.100.1.el8_10 |
| AlmaLinux:8 | kernel-modules | before 4.18.0-553.100.1.el8_10 | 4.18.0-553.100.1.el8_10 |
| AlmaLinux:8 | kernel-modules-extra | before 4.18.0-553.100.1.el8_10 | 4.18.0-553.100.1.el8_10 |
| AlmaLinux:8 | kernel-rt | before 4.18.0-553.100.1.rt7.441.el8_10 | 4.18.0-553.100.1.rt7.441.el8_10 |
| AlmaLinux:8 | kernel-rt-core | before 4.18.0-553.100.1.rt7.441.el8_10 | 4.18.0-553.100.1.rt7.441.el8_10 |
| AlmaLinux:8 | kernel-rt-debug | before 4.18.0-553.100.1.rt7.441.el8_10 | 4.18.0-553.100.1.rt7.441.el8_10 |
| AlmaLinux:8 | kernel-rt-debug-core | before 4.18.0-553.100.1.rt7.441.el8_10 | 4.18.0-553.100.1.rt7.441.el8_10 |
| AlmaLinux:8 | kernel-rt-debug-devel | before 4.18.0-553.100.1.rt7.441.el8_10 | 4.18.0-553.100.1.rt7.441.el8_10 |
| AlmaLinux:8 | kernel-rt-debug-modules | before 4.18.0-553.100.1.rt7.441.el8_10 | 4.18.0-553.100.1.rt7.441.el8_10 |
| AlmaLinux:8 | kernel-rt-debug-modules-extra | before 4.18.0-553.100.1.rt7.441.el8_10 | 4.18.0-553.100.1.rt7.441.el8_10 |
| AlmaLinux:8 | kernel-rt-devel | before 4.18.0-553.100.1.rt7.441.el8_10 | 4.18.0-553.100.1.rt7.441.el8_10 |
| AlmaLinux:8 | kernel-rt-modules | before 4.18.0-553.100.1.rt7.441.el8_10 | 4.18.0-553.100.1.rt7.441.el8_10 |
+96
Same product
linux: all recordsOther highest-scoring records for the same primary product.
- CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV90Now
- CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe KEV89Now
- CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV85Now
Published before and after this one in the same product
- ← EarlierCVE-2024-26764Apr 3, 2024 · fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio13Monitor
- ← EarlierCVE-2024-26765Apr 3, 2024 · LoongArch: Disable IRQ before init_fn() for nonboot CPUs22Monitor
- Later →CVE-2024-26767Apr 3, 2024 · drm/amd/display: fixed integer types and null check locations22Monitor
Remediation
Which version to upgrade to
Fix versions compiled from the vendor, package registries and Microsoft. Verify the vendor's note before upgrading.
| Product / package | Fixed version | Source |
|---|---|---|
| Linux Linux | 115b7f3bc1dce590a6851a2dcf23dc1100c49790 | Vendor (CNA) |
| Linux Linux | 3f38d22e645e2e994979426ea5a35186102ff3c2 | Vendor (CNA) |
| Linux Linux | 4.19.308 | Vendor (CNA) |
| Linux Linux | 47ae64df23ed1318e27bd9844e135a5e1c0e6e39 | Vendor (CNA) |
| Linux Linux | 5.10.211 | Vendor (CNA) |
| Linux Linux | 5.15.150 | Vendor (CNA) |
| Linux Linux | 5.4.270 | Vendor (CNA) |
| Linux Linux | 52dc9a7a573dbf778625a0efca0fca55489f084b | Vendor (CNA) |
| Linux Linux | 5833024a9856f454a964a198c63a57e59e07baf5 | Vendor (CNA) |
| Linux Linux | 6.1.80 | Vendor (CNA) |
| Linux Linux | 6.3 | Vendor (CNA) |
| Linux Linux | 9034a1bec35e9f725315a3bb6002ef39666114d9 | Vendor (CNA) |
| Linux Linux | a2fef1d81becf4ff60e1a249477464eae3c3bc2a | Vendor (CNA) |
| Linux Linux | e6f57c6881916df39db7d95981a8ad2b9c3458d6 | Vendor (CNA) |
| almalinux:bpftool | 4.18.0-553.100.1.el8_10 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:kernel | 4.18.0-553.100.1.el8_10 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:kernel-rt | 4.18.0-553.100.1.rt7.441.el8_10 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:kernel-rt-core | 4.18.0-553.100.1.rt7.441.el8_10 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:kernel-rt-debug | 4.18.0-553.100.1.rt7.441.el8_10 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:kernel-rt-debug-core | 4.18.0-553.100.1.rt7.441.el8_10 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:kernel-rt-debug-devel | 4.18.0-553.100.1.rt7.441.el8_10 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:kernel-rt-debug-modules | 4.18.0-553.100.1.rt7.441.el8_10 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:kernel-rt-debug-modules-extra | 4.18.0-553.100.1.rt7.441.el8_10 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:kernel-rt-devel | 4.18.0-553.100.1.rt7.441.el8_10 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:kernel-rt-modules | 4.18.0-553.100.1.rt7.441.el8_10 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:kernel-rt-modules-extra | 4.18.0-553.100.1.rt7.441.el8_10 · AlmaLinux:8 | Package registry (OSV) |
| debian:linux | 6.1.82-1 · Debian:12 | Package registry (OSV) |
| red hat:kernel-rt | 0:4.18.0-553.100.1.rt7.441.el8_10 · Red Hat:enterprise_linux:8::nfv | Package registry (OSV) |
| red hat:kernel-rt-core | 0:4.18.0-553.100.1.rt7.441.el8_10 · Red Hat:enterprise_linux:8::nfv | Package registry (OSV) |
| red hat:kernel-rt-debug-core | 0:4.18.0-553.100.1.rt7.441.el8_10 · Red Hat:enterprise_linux:8::nfv | Package registry (OSV) |
+23
Exploit status
No known public exploit
No public exploit has been observed yet. That doesn't mean you're safe, only that the bar is a little higher.
Research context
For pentesters and researchers: attack profile, score disagreement, timeline, patch commits, credits, variant and chain candidates, bug bounty scope. All derived from existing data; no exploit code.
Timeline
From publication to today: proof of concept, Metasploit module, CISA KEV and fix record. Dates are as reported by the sources.
No dated events beyond publication.
No history yet (it accumulates with the daily EPSS job).
Patch and commit links
Commit, PR and diff links among the references. A starting point for patch-diffing and variant hunting; fixes, not exploits.
No commit or PR link among the references.
Credits
All researchersFinders, reporters and analysts named in the CNA record. Click a name for that researcher’s other records.
No credits in the CNA record.
Variant candidates
Same product, same weakness class, within 18 months. If the patch missed the root cause, the sibling bug is here.
- CVE-2023-38429261 days apartAn issue was discovered in the Linux kernel before 6.3.4.39Monitor
- CVE-2024-2699528 days apartusb: typec: tcpm: Correct the PDO counting in pd_set31Monitor
- CVE-2022-4867230 days apartof: fdt: fix off-by-one error in unflatten_dt_nodes()31Monitor
- CVE-2021-4704635 days apartdrm/amd/display: Fix off by one in hdmi_14_process_transaction()31Monitor
- CVE-2022-4873278 days apartdrm/nouveau: fix off by one in BIOS boundary checking31Monitor
- CVE-2024-43852136 days aparthwmon: (ltc2991) re-order conditions to fix off by one bug31Monitor
Chain candidates
An authentication bypass and a privilege-requiring bug in the same product, published close together: combined they may become an unauthenticated path.
—
Bug bounty scope
No known public program.
Source: bounty-targets-data (public HackerOne, Bugcrowd, Intigriti, YesWeHack listings).
National notice (Türkiye Cybersecurity Directorate / USOM)
Official security notices citing this record; remediation advice is on the agency's page.
- TR-24-0494 · May 16, 2024(Linux Kernel Güncellemesi)
- TR-24-0265 · Apr 4, 2024(Linux Kernel Güncellemesi)
Technical details
Attack conditions
- Someone with local access to the system can trigger it.
- A low-privileged account is enough.
- No user action is required.
- No special conditions are required; it is repeatable.
If successful
- Confidentiality
- none
- Integrity
- none
- Availability
- high · the service can be disrupted
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality impact
- None
- Integrity impact
- None
- Availability impact
- High
Weakness class (CWE)
CWE-193 · Off-by-one ErrorCVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvd-primary
Attack context
MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.
MITRE has no CAPEC/ATT&CK mapping for this CWE.
Change log
- Fix✗ → ✓
For records you follow, these changes also arrive as notifications. →
References
Show all references (9 more)Show less
- git.kernel.org/stable/c/3f38d22e645e2e994979426ea5a35186102ff3c2
- git.kernel.org/stable/c/47ae64df23ed1318e27bd9844e135a5e1c0e6e39
- git.kernel.org/stable/c/52dc9a7a573dbf778625a0efca0fca55489f084b
- git.kernel.org/stable/c/5833024a9856f454a964a198c63a57e59e07baf5
- git.kernel.org/stable/c/9034a1bec35e9f725315a3bb6002ef39666114d9
- git.kernel.org/stable/c/a2fef1d81becf4ff60e1a249477464eae3c3bc2a
- git.kernel.org/stable/c/e6f57c6881916df39db7d95981a8ad2b9c3458d6
- lists.debian.org/debian-lts-announce/2024/06/msg00017.html
- lists.debian.org/debian-lts-announce/2024/06/msg00020.html
Vendor advisories and official records. Exploit/PoC links are deliberately left out.