Security readout for executives and security teams
Plain-English summary
On affected LoongArch Linux systems, firmware describing more processors than the kernel supports can cause an out-of-bounds write during startup and crash the machine. The demonstrated business impact is failure to boot high-core-count physical or virtual hosts. This is not evidenced as a broadly exploitable Internet-facing flaw.
Executive priority
Prioritize affected LoongArch hosts with more firmware-described processors than their kernel limit, especially critical infrastructure requiring reliable reboot or recovery. Treat remediation as urgent for matching systems. For other architectures or LoongArch systems without the triggering topology, priority is substantially lower pending vendor assessment.
Technical view
During ACPI MADT parsing, CORE_PIC entries could exceed the acpi_core_pic array sized by NR_CPUS. The default limit is 64, while firmware may describe more physical processors. The fix sizes the array using MAX_CORE_PIC. The source demonstrates a boot crash with 128 virtual CPUs and a kernel supporting 64.
Likely exposure
Exposure is limited to affected Linux releases on LoongArch where the MADT describes more physical processors than CONFIG_NR_CPUS permits, particularly above the default 64. Other architectures are not identified as affected. Distribution packages may contain backports, so version numbers alone are insufficient.
Exploitation context
The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. The documented trigger occurs during boot while parsing firmware-provided ACPI data. Although the supplied CVSS vector lists network access and high privileges, the sources do not establish a practical remote attack path.
Researcher notes
The documented defect is an array overflow in LoongArch ACPI CORE_PIC handling. Evidence demonstrates availability impact through a boot-time crash; broader confidentiality or integrity impact is not demonstrated despite the CVSS impact values. The supplied affected-version data is ambiguous, making stable-commit or vendor-backport verification preferable to version-only detection.
Mitigation direction
- Apply a vendor kernel update containing the stable fix for the maintained branch.
- Confirm the installed package includes a cited commit or an equivalent vendor backport.
- Until patched, avoid firmware topologies exceeding CONFIG_NR_CPUS, subject to vendor guidance.
- Reboot after updating and confirm the patched kernel is active.
Validation and detection
- Inventory LoongArch hosts, kernel builds, configurations, and physical or virtual processor counts.
- Compare CONFIG_NR_CPUS with processor entries exposed through the ACPI MADT.
- Check package changelogs or source history for a cited commit or equivalent backport.
- Test representative processor topology in a controlled environment and confirm successful boot.
- Review boot records for early paging faults or kernel oops matching the documented failure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-120: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-26768 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H1.25.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H24CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.2HighVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/88e189bd16e5889e44a41b3309558ebab78b9280CVE reference, Linux
- https://git.kernel.org/stable/c/0f6810e39898af2d2cabd9313e4dbc945fb5dfddCVE reference, Linux
- https://git.kernel.org/stable/c/4551b30525cf3d2f026b92401ffe241eb04dfebeCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.