GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-26785 (GCVE-0-2024-26785)

Vulnerability from cvelistv5 – Published: 2024-04-04 08:20 – Updated: 2026-05-11 20:04
VLAI
Title
iommufd: Fix protection fault in iommufd_test_syz_conv_iova
Summary
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix protection fault in iommufd_test_syz_conv_iova Syzkaller reported the following bug: general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7] Call Trace: lock_acquire lock_acquire+0x1ce/0x4f0 down_read+0x93/0x4a0 iommufd_test_syz_conv_iova+0x56/0x1f0 iommufd_test_access_rw.isra.0+0x2ec/0x390 iommufd_test+0x1058/0x1e30 iommufd_fops_ioctl+0x381/0x510 vfs_ioctl __do_sys_ioctl __se_sys_ioctl __x64_sys_ioctl+0x170/0x1e0 do_syscall_x64 do_syscall_64+0x71/0x140 This is because the new iommufd_access_change_ioas() sets access->ioas to NULL during its process, so the lock might be gone in a concurrent racing context. Fix this by doing the same access->ioas sanity as iommufd_access_rw() and iommufd_access_pin_pages() functions do.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-04 15:19 UTC
CWE
  • CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9227da7816dd1a42e20d41e2244cb63c205477ca , < fd4d5cd7a2e8f08357c9bfc0905957cffe8ce568 (git)
Affected: 9227da7816dd1a42e20d41e2244cb63c205477ca , < fc719ecbca45c9c046640d72baddba3d83e0bc0b (git)
Affected: 9227da7816dd1a42e20d41e2244cb63c205477ca , < cf7c2789822db8b5efa34f5ebcf1621bc0008d48 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.55 , ≤ 6.6.* (semver)
Unaffected: 6.7.9 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-26785",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-04T15:19:21.902975Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-120",
                "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-07T18:54:48.729Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.352Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fc719ecbca45c9c046640d72baddba3d83e0bc0b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cf7c2789822db8b5efa34f5ebcf1621bc0008d48"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommufd/selftest.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fd4d5cd7a2e8f08357c9bfc0905957cffe8ce568",
              "status": "affected",
              "version": "9227da7816dd1a42e20d41e2244cb63c205477ca",
              "versionType": "git"
            },
            {
              "lessThan": "fc719ecbca45c9c046640d72baddba3d83e0bc0b",
              "status": "affected",
              "version": "9227da7816dd1a42e20d41e2244cb63c205477ca",
              "versionType": "git"
            },
            {
              "lessThan": "cf7c2789822db8b5efa34f5ebcf1621bc0008d48",
              "status": "affected",
              "version": "9227da7816dd1a42e20d41e2244cb63c205477ca",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommufd/selftest.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.55",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.9",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Fix protection fault in iommufd_test_syz_conv_iova\n\nSyzkaller reported the following bug:\n\n  general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN\n  KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7]\n  Call Trace:\n   lock_acquire\n   lock_acquire+0x1ce/0x4f0\n   down_read+0x93/0x4a0\n   iommufd_test_syz_conv_iova+0x56/0x1f0\n   iommufd_test_access_rw.isra.0+0x2ec/0x390\n   iommufd_test+0x1058/0x1e30\n   iommufd_fops_ioctl+0x381/0x510\n   vfs_ioctl\n   __do_sys_ioctl\n   __se_sys_ioctl\n   __x64_sys_ioctl+0x170/0x1e0\n   do_syscall_x64\n   do_syscall_64+0x71/0x140\n\nThis is because the new iommufd_access_change_ioas() sets access-\u003eioas to\nNULL during its process, so the lock might be gone in a concurrent racing\ncontext.\n\nFix this by doing the same access-\u003eioas sanity as iommufd_access_rw() and\niommufd_access_pin_pages() functions do."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:04:08.484Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fd4d5cd7a2e8f08357c9bfc0905957cffe8ce568"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc719ecbca45c9c046640d72baddba3d83e0bc0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf7c2789822db8b5efa34f5ebcf1621bc0008d48"
        }
      ],
      "title": "iommufd: Fix protection fault in iommufd_test_syz_conv_iova",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26785",
    "datePublished": "2024-04-04T08:20:18.467Z",
    "dateReserved": "2024-02-19T14:20:24.178Z",
    "dateUpdated": "2026-05-11T20:04:08.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26785",
      "date": "2026-09-17",
      "epss": "0.00225",
      "percentile": "0.13341"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:08:54.000Z",
      "cve": "CVE-2024-26785",
      "id": "msrc_CVE-2024-26785",
      "initial_release_date": "2024-04-02T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "iommufd: Fix protection fault in iommufd_test_syz_conv_iova",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-26785.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26785\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-04T09:15:08.187\",\"lastModified\":\"2026-06-17T07:18:20.440\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommufd: Fix protection fault in iommufd_test_syz_conv_iova\\n\\nSyzkaller reported the following bug:\\n\\n  general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN\\n  KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7]\\n  Call Trace:\\n   lock_acquire\\n   lock_acquire+0x1ce/0x4f0\\n   down_read+0x93/0x4a0\\n   iommufd_test_syz_conv_iova+0x56/0x1f0\\n   iommufd_test_access_rw.isra.0+0x2ec/0x390\\n   iommufd_test+0x1058/0x1e30\\n   iommufd_fops_ioctl+0x381/0x510\\n   vfs_ioctl\\n   __do_sys_ioctl\\n   __se_sys_ioctl\\n   __x64_sys_ioctl+0x170/0x1e0\\n   do_syscall_x64\\n   do_syscall_64+0x71/0x140\\n\\nThis is because the new iommufd_access_change_ioas() sets access-\u003eioas to\\nNULL during its process, so the lock might be gone in a concurrent racing\\ncontext.\\n\\nFix this by doing the same access-\u003eioas sanity as iommufd_access_rw() and\\niommufd_access_pin_pages() functions do.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: iommufd: Se corrigi\u00f3 falla de protecci\u00f3n en iommufd_test_syz_conv_iova Syzkaller inform\u00f3 el siguiente error: falla de protecci\u00f3n general, probablemente para direcci\u00f3n no can\u00f3nica 0xdffffc0000000038: 0000 [#1] SMP KASAN KASAN: null-ptr- deref en el rango [0x00000000000001c0-0x00000000000001c7] Seguimiento de llamadas: lock_acquire lock_acquire+0x1ce/0x4f0 down_read+0x93/0x4a0 iommufd_test_syz_conv_iova+0x56/0x1f0 iommufd_test_access_rw.isra. 0+0x2ec/0x390 iommufd_test+0x1058/0x1e30 iommufd_fops_ioctl+0x381/0x510 vfs_ioctl __do_sys_ioctl __se_sys_ioctl __x64_sys_ioctl +0x170/0x1e0 do_syscall_x64 do_syscall_64+0x71/0x140 Esto se debe a que el nuevo iommufd_access_change_ioas() establece access-\u0026gt;ioas en NULL durante su proceso, por lo que el bloqueo podr\u00eda desaparecer en un contexto de ejecuci\u00f3n concurrente. Solucione este problema haciendo el mismo acceso-\u0026gt;ioas cordura que hacen las funciones iommufd_access_rw() y iommufd_access_pin_pages().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/iommu/iommufd/selftest.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9227da7816dd1a42e20d41e2244cb63c205477ca\",\"lessThan\":\"fd4d5cd7a2e8f08357c9bfc0905957cffe8ce568\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9227da7816dd1a42e20d41e2244cb63c205477ca\",\"lessThan\":\"fc719ecbca45c9c046640d72baddba3d83e0bc0b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9227da7816dd1a42e20d41e2244cb63c205477ca\",\"lessThan\":\"cf7c2789822db8b5efa34f5ebcf1621bc0008d48\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/iommu/iommufd/selftest.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.55\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.9\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-04-04T15:19:21.902975Z\",\"id\":\"CVE-2024-26785\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-120\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.7.9\",\"matchCriteriaId\":\"C85279DE-3279-481E-B737-8FD30F6B3A47\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"A780F817-2A77-4130-A9B7-5C25606314E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"AEB9199B-AB8F-4877-8964-E2BA95B5F15C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/cf7c2789822db8b5efa34f5ebcf1621bc0008d48\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fc719ecbca45c9c046640d72baddba3d83e0bc0b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fd4d5cd7a2e8f08357c9bfc0905957cffe8ce568\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cf7c2789822db8b5efa34f5ebcf1621bc0008d48\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fc719ecbca45c9c046640d72baddba3d83e0bc0b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T06:57:30+00:00",
      "cve": "CVE-2024-26785",
      "id": "CVE-2024-26785",
      "initial_release_date": "2024-04-04T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "98",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iommufd: Fix protection fault in iommufd_test_syz_conv_iova",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26785.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/fc719ecbca45c9c046640d72baddba3d83e0bc0b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/cf7c2789822db8b5efa34f5ebcf1621bc0008d48\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.352Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26785\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-04T15:19:21.902975Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-120\", \"description\": \"CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:21.983Z\"}}], \"cna\": {\"title\": \"iommufd: Fix protection fault in iommufd_test_syz_conv_iova\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9227da7816dd1a42e20d41e2244cb63c205477ca\", \"lessThan\": \"fd4d5cd7a2e8f08357c9bfc0905957cffe8ce568\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9227da7816dd1a42e20d41e2244cb63c205477ca\", \"lessThan\": \"fc719ecbca45c9c046640d72baddba3d83e0bc0b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9227da7816dd1a42e20d41e2244cb63c205477ca\", \"lessThan\": \"cf7c2789822db8b5efa34f5ebcf1621bc0008d48\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/iommu/iommufd/selftest.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.55\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/iommu/iommufd/selftest.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/fd4d5cd7a2e8f08357c9bfc0905957cffe8ce568\"}, {\"url\": \"https://git.kernel.org/stable/c/fc719ecbca45c9c046640d72baddba3d83e0bc0b\"}, {\"url\": \"https://git.kernel.org/stable/c/cf7c2789822db8b5efa34f5ebcf1621bc0008d48\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommufd: Fix protection fault in iommufd_test_syz_conv_iova\\n\\nSyzkaller reported the following bug:\\n\\n  general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN\\n  KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7]\\n  Call Trace:\\n   lock_acquire\\n   lock_acquire+0x1ce/0x4f0\\n   down_read+0x93/0x4a0\\n   iommufd_test_syz_conv_iova+0x56/0x1f0\\n   iommufd_test_access_rw.isra.0+0x2ec/0x390\\n   iommufd_test+0x1058/0x1e30\\n   iommufd_fops_ioctl+0x381/0x510\\n   vfs_ioctl\\n   __do_sys_ioctl\\n   __se_sys_ioctl\\n   __x64_sys_ioctl+0x170/0x1e0\\n   do_syscall_x64\\n   do_syscall_64+0x71/0x140\\n\\nThis is because the new iommufd_access_change_ioas() sets access-\u003eioas to\\nNULL during its process, so the lock might be gone in a concurrent racing\\ncontext.\\n\\nFix this by doing the same access-\u003eioas sanity as iommufd_access_rw() and\\niommufd_access_pin_pages() functions do.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.55\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.9\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"6.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:04:08.484Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26785\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:04:08.484Z\", \"dateReserved\": \"2024-02-19T14:20:24.178Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-04T08:20:18.467Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.