Security readout for executives and security teams
Plain-English summary
A race condition in the Linux irdma RDMA driver can leave deferred interrupt work running while an IRQ is being removed. On an affected system, a locally privileged user may be able to trigger serious memory corruption, potentially affecting confidentiality, integrity, and availability.
Executive priority
Prioritize affected RDMA hosts because successful exploitation could have system-wide impact. Treat patching as high priority, especially on shared or multi-user systems where untrusted local users have accounts. Internet-facing status alone does not determine exposure because the stated attack vector is local.
Technical view
A scheduled tasklet can remain pending on another CPU while the irdma driver deletes its IRQ. Subsequent CEQ processing may access invalid state, as detected by KASAN. The kernel fix kills scheduled tasklets after IRQ deletion. CVSS 3.1 rates the issue 7.8 with local, low-privilege, no-user-interaction access.
Likely exposure
Exposure is limited to affected Linux kernels using the RDMA irdma driver and relevant hardware or configuration. Systems without this driver loaded or used are less likely to be exposed. The supplied version data is ambiguous, so distribution-specific package status should determine applicability.
Exploitation context
The supplied sources do not report active exploitation, and the CVE is not identified as being in CISA KEV. The CVSS vector requires local access and low privileges. No evidence provided establishes reliable exploitation, internet-scale exposure, or a specific attacker campaign.
Researcher notes
The record describes a cross-core tasklet-versus-IRQ-deletion race in irdma CEQ processing. Multiple stable-kernel commits are supplied, but the normalized affected-version list lacks clear ranges and should not be treated as a complete package matrix. No CWE, proof of exploitation, or exploit reliability evidence is provided.
Mitigation direction
- Install a supported kernel update containing the vendor's CVE-2024-26838 fix.
- Check Linux distribution advisories for the exact fixed package version.
- Where operationally acceptable, disable or avoid loading unused irdma functionality until patched.
- Schedule a reboot if required to activate the updated kernel.
Validation and detection
- Inventory kernel versions and identify systems with the irdma module loaded or configured.
- Compare installed packages against distribution guidance for CVE-2024-26838.
- Confirm the running kernel changed after patching and any required reboot.
- Review kernel logs for irdma, KASAN, tasklet, IRQ, or memory-corruption warnings.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-26838 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/635d79aa477f9912e602feb5498bdd51fb9cb824CVE reference, Linux
- https://git.kernel.org/stable/c/b2e4a5266e3d133b4c7f0e43bf40d13ce14fd1aaCVE reference, Linux
- https://git.kernel.org/stable/c/c6f1ca235f68b22b3e691b2ea87ac285e5946848CVE reference, Linux
- https://git.kernel.org/stable/c/0ae8ad0013978f7471f22bcf45b027393e87f5dcCVE reference, Linux
- https://git.kernel.org/stable/c/bd97cea7b18a0a553773af806dfbfac27a7c4acbCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.