Security readout for executives and security teams
Plain-English summary
A Linux kernel flaw affects the Xilinx cryptographic driver used on certain ZynqMP-based systems. Crypto requests could be finalized in an unsafe interrupt context, producing a kernel warning and potentially destabilizing cryptographic processing. The supplied record rates it critical, but does not demonstrate the claimed confidentiality, integrity, or availability impact.
Executive priority
Treat affected ZynqMP appliances and embedded systems as urgent patch-review candidates, especially where cryptographic services support exposed workloads. Avoid assuming every Linux server is critically exposed. Require engineering to establish driver usage, vendor patch status, and operational impact before setting emergency-wide remediation deadlines.
Technical view
The Xilinx ZynqMP AES request handler called crypto_finalize_request without disabling bottom halves. This violated crypto engine context requirements and triggered a warning in a 6.8.0-rc1 Yocto kernel on ZynqMP ZCU102 hardware. Linked Linux stable commits correct the finalization context. The supplied version data is ambiguous and should not be treated as a definitive release matrix.
Likely exposure
Exposure appears limited to Linux systems using the affected Xilinx cryptographic driver, particularly ZynqMP platforms performing hardware-backed AES operations. General Linux hosts without this driver or hardware are unlikely to be exposed. Confirm distribution backports because kernel version numbers alone may be misleading.
Exploitation context
The supplied CVSS is 9.8 and describes remote, unauthenticated impact, but the technical evidence only shows a kernel warning during crypto request finalization. CISA KEV status is false, and no supplied source establishes active exploitation, public weaponization, or reliable remote reachability.
Researcher notes
The trace identifies crypto_finalize_aead_request, zynqmp_handle_aes_req, and crypto_pump_work. The correction concerns bottom-half state around request finalization. Evidence supports a context-safety defect and observable warning, but not the full CVSS impact claim. Affected-version interpretation is uncertain because the supplied normalized list omits range and status detail.
Mitigation direction
- Install a vendor-supported kernel containing the applicable Linux stable correction.
- Check distribution, embedded Linux, and device-vendor advisories for backported fixes.
- If immediate updating is impossible, assess whether the Xilinx crypto driver can be safely disabled.
- Prioritize ZynqMP systems processing untrusted or network-originated cryptographic workloads.
Validation and detection
- Inventory ZynqMP devices and determine whether the Xilinx crypto driver is loaded or built in.
- Compare kernel provenance and vendor patches against the linked stable commits.
- Review kernel logs for crypto_finalize_request warnings associated with zynqmp_handle_aes_req.
- Exercise approved cryptographic regression tests after updating the kernel.
- Confirm hardware AES operations complete without warnings or service disruption.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-26877 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8a01335aedc50a66d04dd39203c89f4bc8042596CVE reference, Linux
- https://git.kernel.org/stable/c/03e6d4e948432a61b35783323b6ab2be071d2619CVE reference, Linux
- https://git.kernel.org/stable/c/a71f66bd5f7b9b35a8aaa49e29565eca66299399CVE reference, Linux
- https://git.kernel.org/stable/c/23bc89fdce71124cd2126fc919c7076e7cb489cfCVE reference, Linux
- https://git.kernel.org/stable/c/9db89b1fb85557892e6681724b367287de5f9f20CVE reference, Linux
- https://git.kernel.org/stable/c/dbf291d8ffffb70f48286176a15c6c54f0bb0743CVE reference, Linux
- https://git.kernel.org/stable/c/a853450bf4c752e664abab0b2fad395b7ad7701cCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.