LiveActive security incident?Get immediate response
CVE Record

CVE-2024-26678: x86/efistub: Use 1:1 file:memory mapping for PE/COFF .compat section

In the Linux kernel, the following vulnerability has been resolved: x86/efistub: Use 1:1 file:memory mapping for PE/COFF .compat section The .compat section is a dummy PE section that contains the address of the 32-bit entrypoint of the 64-bit kernel image if it is bootable from 32-bit firmware (i.e., CONFIG_EFI_MIXED=y) This section is only 8 bytes in size and is only referenced from the loader, and so it is placed at the end of the memory view of the image, to avoid the need for padding it to 4k, which is required for sections appearing in the middle of the image. Unfortunately, this violates the PE/COFF spec, and even if most EFI loaders will work correctly (including the Tianocore reference implementation), PE loaders do exist that reject such images, on the basis that both the file and memory views of the file contents should be described by the section headers in a monotonically increasing manner without leaving any gaps. So reorganize the sections to avoid this issue. This results in a slight padding overhead (< 4k) which can be avoided if desired by disabling CONFIG_EFI_MIXED (which is only needed in rare cases these days)

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects how some x86 EFI boot images describe a small compatibility section. Most EFI loaders reportedly accept the image, but stricter PE/COFF loaders may reject it. The likely business impact is failed boot or deployment on affected firmware/loaders, not remote compromise, based on the provided sources.

Executive priority

Low immediate security urgency, but prioritize for fleets where kernel boot reliability across EFI firmware is operationally important. Bundle validation into normal kernel maintenance unless affected systems show boot failures.

Technical view

With CONFIG_EFI_MIXED enabled, the x86 EFI stub placed the 8-byte PE/COFF .compat section at the end of the memory view, leaving a layout some PE loaders reject. Stable kernel commits reorganize sections to use a 1:1 file-to-memory mapping, adding less than 4 KB padding.

Likely exposure

Exposure appears limited to Linux 6.7 through 6.7.5 and 6.8 kernels using affected x86 EFI stub behavior, especially images built with CONFIG_EFI_MIXED for 32-bit firmware boot support.

Exploitation context

The bundle shows no CISA KEV listing, no CVSS score, and no evidence of active exploitation. The described failure mode is loader rejection of a kernel image, so treat it as a boot compatibility and availability issue unless vendor guidance says otherwise.

Researcher notes

The CVE record describes a PE/COFF layout conformance issue in the EFI stub. Evidence does not indicate memory corruption, privilege escalation, or remote attack surface. Version data in the bundle is sparse and duplicated, so validate against distro kernel backports.

Mitigation direction

  • Update to a kernel containing the referenced stable fixes.
  • Check vendor distribution advisories for packaged kernel availability.
  • If appropriate, disable CONFIG_EFI_MIXED where 32-bit firmware boot is not needed.
  • Test updated boot images on representative EFI loaders before broad rollout.

Validation and detection

  • Inventory systems running Linux 6.7, 6.7.5, or 6.8 kernels.
  • Confirm whether kernel builds enable CONFIG_EFI_MIXED.
  • Verify installed kernel source includes one of the referenced stable commits.
  • Reboot-test representative affected hardware or firmware profiles after updating.
Prepared
Confidence
medium
Sources
6

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-26678 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc4421279b6c278efe129bde7abc64af59ea2dfbd, 686b58ce5052842bd34ea94870a2671317331716, 3e3eabe26dc88692d34cf76ca0e0dd331481cc15, 3e3eabe26dc88692d34cf76ca0e0dd331481cc15unaffected
LinuxLinux6.7, 0, 6.7.5, 6.8affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.