LiveActive security incident?Get immediate response
CVE Record

CVE-2024-26714: interconnect: qcom: sc8180x: Mark CO0 BCM keepalive

In the Linux kernel, the following vulnerability has been resolved: interconnect: qcom: sc8180x: Mark CO0 BCM keepalive The CO0 BCM needs to be up at all times, otherwise some hardware (like the UFS controller) loses its connection to the rest of the SoC, resulting in a hang of the platform, accompanied by a spectacular logspam. Mark it as keepalive to prevent such cases.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2024-26714 is a Linux kernel stability flaw on Qualcomm SC8180X platforms. A required interconnect component was not kept active, which can make hardware such as the UFS storage controller lose connectivity and hang the platform. The public record does not provide CVSS, CWE, or evidence of exploitation.

Executive priority

Treat this as targeted operational risk, not broad emergency patching. Prioritize embedded, laptop, or appliance fleets known to use SC8180X Linux kernels, especially where hangs affect service availability or field reliability.

Technical view

The fix marks the SC8180X CO0 BCM as keepalive in the Qualcomm interconnect driver. Without that, CO0 BCM may be turned off even though hardware depends on it continuously, causing SoC connectivity loss, platform hangs, and excessive logging. The affected record cites Linux kernel versions including 5.15, 6.1.79, 6.6.18, 6.7.6, and 6.8.

Likely exposure

Exposure is likely limited to Linux systems using Qualcomm SC8180X hardware and affected kernel builds. Downstream vendor kernels may differ because backports are common, so exposure should be confirmed by kernel version, vendor advisories, and whether the relevant stable fix is present.

Exploitation context

CISA KEV status is false in the provided bundle, and no cited source states active exploitation. The source material describes a reliability and availability failure, not a remote attack path or privilege escalation technique.

Researcher notes

The public data is sparse: no CVSS, CWE, exploitability analysis, or detailed affected downstream products are provided. The commit rationale supports an availability impact tied to power/interconnect management on SC8180X, with remediation represented by stable kernel commits.

Mitigation direction

  • Update to a kernel release or vendor build containing the referenced stable fix.
  • Check OEM or distribution kernel advisories for SC8180X backports.
  • Prioritize systems showing UFS, storage, or platform hang symptoms.
  • Test patched kernels on representative SC8180X hardware before broad rollout.

Validation and detection

  • Inventory Linux systems running Qualcomm SC8180X hardware.
  • Confirm whether the kernel includes the CO0 BCM keepalive fix.
  • Review system logs for repeated interconnect, UFS, or platform hang messages.
  • Verify storage stability after applying the vendor-supported kernel update.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-26714 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux9c8c6bac1ae86f6902baa938101902fb3a0a100b, 9c8c6bac1ae86f6902baa938101902fb3a0a100b, 9c8c6bac1ae86f6902baa938101902fb3a0a100b, 9c8c6bac1ae86f6902baa938101902fb3a0a100bunaffected
LinuxLinux5.15, 0, 6.1.79, 6.6.18, 6.7.6, 6.8affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.