Security readout for executives and security teams
Plain-English summary
A flaw in Linux device-mapper suspend and resume handling can corrupt an internal list and crash the kernel. It was observed during LVM2 testing. Because exploitation requires local access and no active exploitation is documented, this is a serious patching issue rather than an internet-wide emergency.
Executive priority
Schedule high-priority remediation for Linux infrastructure using LVM snapshots, especially shared or multi-user systems. Accelerate patching where an unexpected kernel crash could interrupt critical services. Immediate emergency response is not supported by the supplied exploitation evidence.
Technical view
Device-mapper could call a target’s postsuspend method twice without an intervening resume. For dm-snapshot, the second origin_postsuspend call removes an already-removed hash_list entry, causing list corruption and a kernel BUG. The fix restores preresume/resume pairing and safely preserves suspension when preresume fails.
Likely exposure
Exposure is most likely on affected Linux kernels using device-mapper, particularly LVM snapshot suspend and resume paths. The CVSS vector requires local access and low privileges; no network attack path is identified. Exact distribution exposure depends on vendor backports and package status.
Exploitation context
The supplied sources document a reproducible kernel crash during LVM2 tests but provide no evidence of active exploitation; the CVE is not listed as KEV. The 7.8 CVSS assessment indicates potentially high confidentiality, integrity, and availability impact, although the supplied technical evidence directly demonstrates list corruption and kernel failure.
Researcher notes
The failure results from unpaired target lifecycle callbacks: two consecutive origin_postsuspend calls attempt duplicate hash_list removal. The stable fix makes __dm_internal_resume call target preresume and resume methods. If preresume fails, it retains DMF_SUSPENDED and simulates normal suspension to avoid another callback mismatch and crash.
Mitigation direction
- Install a distribution or vendor kernel containing the CVE-2024-26880 fix.
- Reboot affected systems into the updated kernel.
- Check distribution and appliance advisories for backport and fixed-package status.
- Prioritize systems using LVM snapshots or exposing local access to untrusted users.
Validation and detection
- Inventory running kernel and package versions on systems using LVM or device-mapper.
- Confirm vendor advisories or changelogs include CVE-2024-26880 or a cited stable fix.
- After rebooting, verify the running kernel matches the installed fixed package.
- Review kernel logs for list corruption, invalid opcode, BUG, or dm_snapshot traces.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-26880 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L2.83.4CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
6.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/69836d9329f0b4c58faaf3d886a7748ddb5bf718CVE reference, Linux
- https://git.kernel.org/stable/c/da7ece2197101b1469853e6b5e915be1e3896d52CVE reference, Linux
- https://git.kernel.org/stable/c/f89bd27709376d37ff883067193320c58a8c1d5aCVE reference, Linux
- https://git.kernel.org/stable/c/03ad5ad53e51abf3a4c7538c1bc67a5982b41dc5CVE reference, Linux
- https://git.kernel.org/stable/c/ad10289f68f45649816cc68eb93f45fd5ec48a15CVE reference, Linux
- https://git.kernel.org/stable/c/15a3fc5c8774c17589dabfe1d642d40685c985afCVE reference, Linux
- https://git.kernel.org/stable/c/ef02d8edf738557af2865c5bfb66a03c4e071be7CVE reference, Linux
- https://git.kernel.org/stable/c/360a7d1be8112654f1fb328ed3862be630bca3f4CVE reference, Linux
- https://git.kernel.org/stable/c/65e8fbde64520001abf1c8d0e573561b4746ef38CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlCVE reference, CVE · x_transferred
- https://cert-portal.siemens.com/productcert/html/ssa-398330.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.