Security readout for executives and security teams
Plain-English summary
A race condition in the Linux RDMA SCSI target component can cause kernel memory to be used after it is freed. A locally authenticated, low-privileged user may be able to trigger serious system compromise or disruption. Exposure is concentrated on systems using the SRP target functionality, not every Linux host.
Executive priority
Treat as high priority for systems actively using SRP target services, especially shared or locally accessible infrastructure. For hosts without this functionality, verify non-exposure and handle through normal kernel patching. No supplied evidence supports an emergency response for active exploitation.
Technical view
The srpt event handler could be registered before device initialization completed. If initialization then failed, the partially configured handler could remain and race with cleanup, producing a use-after-free write in srpt_refresh_port(). The stable fix delays handler registration until initialization completes.
Likely exposure
Prioritize Linux storage, virtualization, or appliance systems where RDMA/SRP target functionality is enabled or loaded. The supplied version data identifies affected Linux releases but is ambiguous enough that exact package exposure should be confirmed through distribution or appliance-vendor advisories.
Exploitation context
The CVSS vector describes local access with low privileges, no user interaction, and potentially complete confidentiality, integrity, and availability impact. The supplied record is not in KEV and provides no evidence of active exploitation or a public exploit.
Researcher notes
The vulnerability is a rare initialization and cleanup race involving event-handler lifetime. KASAN observed a use-after-free write in srpt_refresh_port(). The source bundle does not identify a CWE, reliable trigger conditions, or exploitation in the wild. Its affected-version presentation should not be used alone for package-level conclusions.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable fix.
- Check distribution and appliance advisories for exact fixed package versions.
- Restrict local access on exposed systems until updates are applied.
- Disable unused RDMA/SRP target functionality according to vendor guidance.
Validation and detection
- Inventory kernel versions on systems providing RDMA-backed storage services.
- Confirm whether the srpt component is enabled, loaded, or required.
- Map installed packages to vendor-fixed releases or referenced stable commits.
- Review kernel and KASAN logs for srpt initialization errors or use-after-free reports.
- Retest required RDMA storage operations after updating or disabling functionality.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-26872 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/bdd895e0190c464f54f84579e7535d80276f0fc5CVE reference, Linux
- https://git.kernel.org/stable/c/6413e78086caf7bf15639923740da0d91fdfd090CVE reference, Linux
- https://git.kernel.org/stable/c/e362d007294955a4fb929e1c8978154a64efdcb6CVE reference, Linux
- https://git.kernel.org/stable/c/85570b91e4820a0db9d9432098778cafafa7d217CVE reference, Linux
- https://git.kernel.org/stable/c/7104a00fa37ae898a827381f1161fa3286c8b346CVE reference, Linux
- https://git.kernel.org/stable/c/ec77fa12da41260c6bf9e060b89234b980c5130fCVE reference, Linux
- https://git.kernel.org/stable/c/c21a8870c98611e8f892511825c9607f1e2cd456CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.