Security readout for executives and security teams
Plain-English summary
This is a Linux kernel reliability flaw affecting PowerPC pSeries systems. Dynamically adding a PCI device through DLPAR can leave IOMMU state uninitialized and crash the kernel. Business risk is mainly availability for specialized IBM Power environments, not broad internet exposure.
Executive priority
Prioritize where IBM Power systems support critical workloads or require live PCI reconfiguration. This is not broadly internet-exposed, but it can affect uptime during hardware changes or capacity operations.
Technical view
The issue is an incomplete pci_controller initialization path during DLPAR PCI add on powerpc/pseries. After commit a940904443e4, boot-time PCI discovery registers the iommu_device, but the DLPAR add path did not. The fix registers the IOMMU device during DLPAR add.
Likely exposure
Likely limited to Linux on IBM Power pSeries environments using dynamic PCI device add through DLPAR. The bundle lists Linux kernel versions including 6.4, 6.6.19, 6.7.7, and 6.8 as affected, but distribution-specific status must be verified.
Exploitation context
The provided sources describe a kernel NULL pointer dereference during a DLPAR PCI add operation. There is no KEV listing and no cited evidence of active exploitation. The observable risk is a local or administrative operational crash path, not a remote attack path.
Researcher notes
Evidence is strongest for a regression in the pSeries DLPAR PCI add path. The sources do not provide CVSS, CWE, exploitability detail, or distribution package mapping. Treat affected-version data as upstream-oriented and validate against vendor kernels.
Mitigation direction
- Upgrade affected pSeries kernels to vendor-supported builds containing the referenced stable fixes.
- Check Linux distribution advisories for exact fixed package versions.
- Avoid nonessential DLPAR PCI add operations on affected systems until patched.
- Plan updates during a maintenance window because the failure mode is kernel crash.
Validation and detection
- Inventory Linux systems running on IBM Power pSeries hardware.
- Identify systems using DLPAR or dynamic PCI device add workflows.
- Confirm kernel builds include one of the referenced stable commits or vendor backports.
- Review logs for oops traces involving iommu_init_device or sysfs_add_link_to_group.
- Test DLPAR PCI add behavior after patching in a controlled environment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-26738 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b8315b2e25b4e68e42fcb74630f824b9a5067765CVE reference, Linux
- https://git.kernel.org/stable/c/46e36ebd5e00a148b67ed77c1d31675996f77c25CVE reference, Linux
- https://git.kernel.org/stable/c/a5c57fd2e9bd1c8ea8613a8f94fd0be5eccbf321CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.