Security readout for executives and security teams
Plain-English summary
A bounds-checking flaw in the Linux AMD display driver could allow an array index to exceed its valid range, causing kernel memory corruption. The supplied CVSS score is 7.8 (High). Exploitation requires local, low-privileged access, and the available evidence does not establish real-world attacks.
Executive priority
Treat as a high-priority kernel maintenance issue on affected AMD graphics systems, especially multi-user endpoints. It is not an internet-exploitable emergency based on the supplied evidence. Remediate through normal expedited patching, while validating vendor backports and limiting untrusted local access.
Technical view
The map_hw_resources function in AMDGPU display code could index two mapping arrays beyond their six-element bounds. The kernel fix checks the index and ignores excess data. CVSS 3.1 rates the issue local, low complexity, low privileges, no user interaction, with potentially high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is limited to Linux systems running an affected kernel with the relevant AMD display driver path. The bundle identifies Linux 6.7 through boundaries involving 6.7.9 and 6.8, but its version formatting does not clearly state inclusivity. Distribution backports may change exposure.
Exploitation context
CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. The CVSS vector describes a local attack requiring low privileges. Exact triggering conditions, practical exploitability, and whether reliable privilege escalation is possible are not established by the bundle.
Researcher notes
The flaw was reported by Smatch in dml2_wrapper.c, where stream and plane mapping arrays could be indexed out of bounds. The corrective behavior bounds-checks the index and ignores extra data. The sources do not document attacker-controlled input provenance, crash evidence, exploit reliability, or a demonstrated security outcome.
Mitigation direction
- Update to a vendor-supported kernel containing one of the cited upstream fixes or its verified backport.
- Check distribution security advisories and package changelogs for CVE-2024-26797 remediation status.
- Prioritize affected shared workstations or systems where untrusted local users can execute code.
- Restrict unnecessary local access until affected kernels are remediated.
Validation and detection
- Inventory kernel versions on systems using AMD GPUs or the AMD display driver.
- Confirm whether distribution kernel packages include either cited fix commit or an equivalent backport.
- Recheck exposure after rebooting into the remediated kernel.
- Use vendor advisories to resolve ambiguous version boundaries before closing findings.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-120: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-26797 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/50a6302cf881f67f1410461a68fe9eabd00ff31dCVE reference, Linux
- https://git.kernel.org/stable/c/0f8ca019544a252d1afb468ce840c6dcbac73af4CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.