Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can crash a system path in the idxd DMA engine driver when hardened user-copy checks are enabled. It appears tied to copying completion records from an event log cache to user space. The source bundle does not show remote exploitation, public exploit use, or a CVSS score.
Executive priority
Treat as a targeted kernel stability risk, not a broad internet-facing emergency based on available evidence. Patch through normal kernel maintenance, with higher priority for systems using idxd acceleration or workloads sensitive to kernel crashes.
Technical view
The idxd driver created an event log cache with kmem_cache_create(), then copied completion records from that cache to user space. With CONFIG_HARDENED_USERCOPY, the copy can trigger a usercopy safety failure and kernel BUG. The fix uses kmem_cache_create_usercopy() for safe copying.
Likely exposure
Exposure is likely limited to affected Linux kernel versions listed in the source bundle where the idxd driver path is present and CONFIG_HARDENED_USERCOPY is enabled. The bundle lists Linux 6.4, 6.6.21, 6.7.9, and 6.8 as affected entries, but version-range details are incomplete.
Exploitation context
The source bundle provides no evidence of active exploitation and marks KEV as false. It documents a reproducible kernel BUG condition, not a remote attack chain. Any exploitability beyond denial of service or fault triggering is not established by the provided sources.
Researcher notes
Key evidence is the kernel trace and fix rationale: hardened usercopy rejects copying from the original SLUB cache object, causing usercopy_abort. The remediation changes allocation semantics to kmem_cache_create_usercopy(). No CWE, CVSS, exploit status, or distribution-specific package data is provided.
Mitigation direction
- Update to a kernel containing the referenced stable fixes.
- Check Linux vendor advisories for your distribution-specific fixed package.
- Prioritize systems using the idxd driver or Intel DSA-related acceleration paths.
- Avoid disabling hardening as a workaround unless vendor guidance explicitly requires it.
Validation and detection
- Inventory Linux kernel versions against the affected versions in the CVE record.
- Check whether CONFIG_HARDENED_USERCOPY is enabled in deployed kernels.
- Identify systems loading or using the idxd kernel module.
- Confirm installed kernels include one of the referenced stable commits or vendor backports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-26746 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/5e3022ea42e490a36ec6f2cfa6fc603deb0bace4CVE reference, Linux
- https://git.kernel.org/stable/c/bb71e040323175e18c233a9afef32ba14fa64eb7CVE reference, Linux
- https://git.kernel.org/stable/c/d3ea125df37dc37972d581b74a5d3785c3f283abCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.