Security readout for executives and security teams
Plain-English summary
A flaw in Linux NFSv4.2 extended-attribute handling can trigger a kernel BUG when a local user requests an attribute list using a precisely sized buffer. This may crash or destabilize an affected system. The supplied CVSS score is 7.8, but the sources do not demonstrate data theft, privilege escalation, or remote exploitation.
Executive priority
Treat as a high-priority kernel maintenance issue on exposed multi-user or NFS-dependent systems. Expedite patching where untrusted local accounts exist. Routine prioritization may be appropriate for isolated systems without NFSv4.2 use, subject to vendor confirmation. No active exploitation is established by the supplied evidence.
Technical view
nfs4_listxattr() could exhaust the caller’s buffer in earlier processing and still call nfs4_listxattr_nfs4_user() with zero remaining space, triggering hardened user-copy checks at mm/usercopy.c:102. The kernel fix returns ERANGE when the generated attribute-list length exceeds the supplied nonzero buffer.
Likely exposure
Exposure requires an affected Linux kernel, NFSv4.2-related extended attributes, and local low-privileged access capable of invoking listxattr(). The supplied version data identifies affected kernel lines from 5.9 through listed 5.10, 5.15, 6.1, 6.6, 6.7, 6.8, and 6.9 points, but exact distribution package status requires vendor confirmation.
Exploitation context
The CVSS vector describes local, low-complexity exploitation requiring low privileges and no user interaction. The source bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public weaponized exploit. The documented reproduction demonstrates a kernel BUG, not confirmed privilege escalation.
Researcher notes
The stated trigger involves system.nfs4_acl and a 16-byte listxattr buffer. The remediation adds a bounds check returning ERANGE. Researchers should distinguish the demonstrated user-copy BUG from the CVSS confidentiality and integrity impacts, which are not substantiated in the supplied narrative. Exact vulnerable and fixed package boundaries are distribution-specific.
Mitigation direction
- Install a vendor-supported kernel containing the linked NFSv4.2 fix or an equivalent backport.
- Reboot affected systems into the updated kernel after installation.
- Consult distribution and appliance advisories to confirm fixed package versions.
- Prioritize multi-user systems where untrusted local users can access NFSv4.2 filesystems.
Validation and detection
- Inventory running kernel versions and systems using NFSv4.2 mounts.
- Confirm the installed kernel includes the upstream fix or a documented vendor backport.
- Verify systems are running the updated kernel after reboot.
- Review kernel logs for usercopy_abort, mm/usercopy.c:102, or nfs4_listxattr-related crashes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-26870 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4403438eaca6e91f02d272211c4d6b045092396bCVE reference, Linux
- https://git.kernel.org/stable/c/9d52865ff28245fc2134da9f99baff603a24407aCVE reference, Linux
- https://git.kernel.org/stable/c/06e828b3f1b206de08ef520fc46a40b22e1869cbCVE reference, Linux
- https://git.kernel.org/stable/c/79cdcc765969d23f4e3d6ea115660c3333498768CVE reference, Linux
- https://git.kernel.org/stable/c/80365c9f96015bbf048fdd6c8705d3f8770132bfCVE reference, Linux
- https://git.kernel.org/stable/c/23bfecb4d852751d5e403557dd500bb563313bafCVE reference, Linux
- https://git.kernel.org/stable/c/251a658bbfceafb4d58c76b77682c8bf7bcfad65CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.