CVE-2024-26840: Linux vulnerability

CVE-2024-26840: cachefiles: fix memory leak in cachefiles_add_cache()

In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix memory leak in cachefiles_add_cache() The following memory leak was reported after unbinding /dev/cachefiles: ================================================================== unreferenced object 0xffff9b674176e3c0 (size 192): comm "cachefilesd2", pid 680, jiffies 4294881224 hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc ea38a44b): [<ffffffff8eb8a1a5>] kmem_cache_alloc+0x2d5/0x370 [<ffffffff8e917f86>] prepare_creds+0x26/0x2e0 [<ffffffffc002eeef>] cachefiles_determine_cache_security+0x1f/0x120 [<ffffffffc00243ec>] cachefiles_add_cache+0x13c/0x3a0 [<ffffffffc0025216>] cachefiles_daemon_write+0x146/0x1c0 [<ffffffff8ebc4a3b>] vfs_write+0xcb/0x520 [<ffffffff8ebc5069>] ksys_write+0x69/0xf0 [<ffffffff8f6d4662>] do_syscall_64+0x72/0x140 [<ffffffff8f8000aa>] entry_SYSCALL_64_after_hwframe+0x6e/0x76 ================================================================== Put the reference count of cache_cred in cachefiles_daemon_unbind() to fix the problem. And also put cache_cred in cachefiles_add_cache() error branch to avoid memory leaks.

UnknownCVSS not scoredNot KEV-listedUpdatedMay 11, 2026, 20:05 UTC (UTC+00:00)

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue is a memory leak in the CacheFiles subsystem. When cachefiles is unbound, credential memory may not be released correctly. The likely business impact is availability risk on systems using CacheFiles/FS-Cache, not data theft. The source bundle does not show active exploitation or a CVSS score.

Executive priority

Prioritize routine kernel patching for systems using CacheFiles or file caching services. Escalate if such systems are internet-critical, memory-constrained, or already showing unexplained kernel memory pressure. No source supports emergency response for active exploitation.

Technical view

The bug is in cachefiles_add_cache() and cachefiles_daemon_unbind(). cache_cred reference counts were not released in normal unbind and some error paths, leaking kernel memory after /dev/cachefiles unbind activity. Linux stable commits add the missing reference release paths.

Likely exposure

Exposure is most likely on Linux systems that enable or operate the CacheFiles cachefilesd path. Systems not using CacheFiles/FS-Cache are less likely exposed in practice, though kernel package inventory should still be checked against vendor advisories.

Exploitation context

The provided sources describe a kernel memory leak reported during cachefiles unbind. They do not claim remote exploitation, privilege escalation, public exploit availability, or KEV listing. Treat exploitation evidence as incomplete and currently unsupported by the bundle.

Researcher notes

The CVE record provides no CVSS, CWE, or exploit claim. Analysis should focus on affected kernel branch mapping, whether CacheFiles code is reachable in the deployed configuration, and whether distribution kernels have backported the stable fix.

Mitigation direction

Identify Linux systems running affected kernel versions and cachefiles services.
Apply vendor kernel updates that include the referenced stable fixes.
For Debian LTS systems, review the cited Debian security announcements.
If patching is delayed, check vendor guidance for safe CacheFiles disablement options.

Validation and detection

Confirm installed kernel versions against vendor advisories and fixed stable releases.
Check whether cachefilesd or CacheFiles/FS-Cache is enabled on relevant hosts.
Review kernel logs and monitoring for abnormal memory growth around cachefiles operations.
Verify updated kernels include one of the referenced upstream stable commits.

Prepared: Jun 1, 2026, 15:57 UTC (UTC+00:00)
Confidence: medium
Sources: 12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-26840 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Apr 17, 2024, 10:10 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

3Timeline events

2ADP providers

11Source links

SSVC decision data

Timestamp: May 28, 2024, 19:58 UTC (UTC+00:00)
Version: 2.0.3

Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
Feb 19, 2024, 14:20 UTC (UTC+00:00)
CVE publishedCVE Program
The CVE record was published.
Apr 17, 2024, 10:10 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
May 11, 2026, 20:05 UTC (UTC+00:00)

ADP provider summaries

other:ssvc

Source materials

CVE List V5 sourceCVE List V5
https://git.kernel.org/stable/c/cb5466783793e66272624cf71925ae1d1ba32083CVE reference, Linux
https://git.kernel.org/stable/c/037d5a949b0455540ef9aab34c10ddf54b65d285CVE reference, Linux
https://git.kernel.org/stable/c/43eccc5823732ba6daab2511ed32dfc545a666d8CVE reference, Linux
https://git.kernel.org/stable/c/94965be37add0983672e48ecb33cdbda92b62579CVE reference, Linux
https://git.kernel.org/stable/c/8b218e2f0a27a9f09428b1847b4580640b9d1e58CVE reference, Linux
https://git.kernel.org/stable/c/38e921616320d159336b0ffadb09e9fb4945c7c3CVE reference, Linux
https://git.kernel.org/stable/c/9cac69912052a4def571fedf1cb9bb4ec590e25aCVE reference, Linux
https://git.kernel.org/stable/c/e21a2f17566cbd64926fb8f16323972f7a064444CVE reference, Linux
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlCVE reference, CVE · x_transferred

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

LinuxLinux9ae326a69004dea8af2dae4fde58de27db700a8d, 9ae326a69004dea8af2dae4fde58de27db700a8d, 9ae326a69004dea8af2dae4fde58de27db700a8d, 9ae326a69004dea8af2dae4fde58de27db700a8d, 9ae326a69004dea8af2dae4fde58de27db700a8d, 9ae326a69004dea8af2dae4fde58de27db700a8d, 9ae326a69004dea8af2dae4fde58de27db700a8d, 9ae326a69004dea8af2dae4fde58de27db700a8dunaffected

LinuxLinux2.6.30, 0, 4.19.309, 5.4.271, 5.10.212, 5.15.151, 6.1.80, 6.6.19, 6.7.7, 6.8affected

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.