CVE-2024-26678: x86/efistub: Use 1:1 file:memory mapping for PE/COFF .compat section
In the Linux kernel, the following vulnerability has been resolved:
x86/efistub: Use 1:1 file:memory mapping for PE/COFF .compat section
The .compat section is a dummy PE section that contains the address of
the 32-bit entrypoint of the 64-bit kernel image if it is bootable from
32-bit firmware (i.e., CONFIG_EFI_MIXED=y)
This section is only 8 bytes in size and is only referenced from the
loader, and so it is placed at the end of the memory view of the image,
to avoid the need for padding it to 4k, which is required for sections
appearing in the middle of the image.
Unfortunately, this violates the PE/COFF spec, and even if most EFI
loaders will work correctly (including the Tianocore reference
implementation), PE loaders do exist that reject such images, on the
basis that both the file and memory views of the file contents should be
described by the section headers in a monotonically increasing manner
without leaving any gaps.
So reorganize the sections to avoid this issue. This results in a slight
padding overhead (< 4k) which can be avoided if desired by disabling
CONFIG_EFI_MIXED (which is only needed in rare cases these days)
Security readout for executives and security teams
Plain-English summary
This Linux kernel issue affects how some x86 EFI boot images describe a small compatibility section. Most EFI loaders reportedly accept the image, but stricter PE/COFF loaders may reject it. The likely business impact is failed boot or deployment on affected firmware/loaders, not remote compromise, based on the provided sources.
Executive priority
Low immediate security urgency, but prioritize for fleets where kernel boot reliability across EFI firmware is operationally important. Bundle validation into normal kernel maintenance unless affected systems show boot failures.
Technical view
With CONFIG_EFI_MIXED enabled, the x86 EFI stub placed the 8-byte PE/COFF .compat section at the end of the memory view, leaving a layout some PE loaders reject. Stable kernel commits reorganize sections to use a 1:1 file-to-memory mapping, adding less than 4 KB padding.
Likely exposure
Exposure appears limited to Linux 6.7 through 6.7.5 and 6.8 kernels using affected x86 EFI stub behavior, especially images built with CONFIG_EFI_MIXED for 32-bit firmware boot support.
Exploitation context
The bundle shows no CISA KEV listing, no CVSS score, and no evidence of active exploitation. The described failure mode is loader rejection of a kernel image, so treat it as a boot compatibility and availability issue unless vendor guidance says otherwise.
Researcher notes
The CVE record describes a PE/COFF layout conformance issue in the EFI stub. Evidence does not indicate memory corruption, privilege escalation, or remote attack surface. Version data in the bundle is sparse and duplicated, so validate against distro kernel backports.
Mitigation direction
Update to a kernel containing the referenced stable fixes.
Check vendor distribution advisories for packaged kernel availability.
If appropriate, disable CONFIG_EFI_MIXED where 32-bit firmware boot is not needed.
Test updated boot images on representative EFI loaders before broad rollout.
Validation and detection
Inventory systems running Linux 6.7, 6.7.5, or 6.8 kernels.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2024-26678 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.