Security readout for executives and security teams
Plain-English summary
A Linux kernel memory-safety flaw can free an IBM s390 cryptographic-card object while the kernel still uses it. Testing reproduced corruption when crypto cards were hot-plugged in KVM guests. Successful exploitation could compromise confidentiality, integrity, or availability, but the affected hardware and architecture make exposure relatively narrow.
Executive priority
Treat as high priority for identified s390/zcrypt systems, especially virtualized environments using crypto-card hot-plugging. Broader enterprise urgency is lower because exposure is architecture-specific and no active exploitation is documented. Remediate through normal accelerated kernel maintenance rather than assuming internet-wide risk.
Technical view
Incorrect reference counting in the s390 zcrypt subsystem causes a use-after-free involving struct zcrypt_card and its load field. The supplied CVSS 3.1 score is 7.8, requiring local access and low privileges, without user interaction. Upstream Linux stable commits resolve the object-lifetime error.
Likely exposure
Prioritize Linux systems on IBM s390 architecture that use zcrypt-supported cryptographic cards, particularly KVM guests where cards may be hot-plugged. Ordinary Linux systems without this architecture or subsystem are unlikely to be exposed. Confirm distribution-specific affected and fixed versions because the supplied version data is complex.
Exploitation context
The supplied record does not establish active exploitation, and the CVE is not listed as CISA KEV. Reproduction occurred during crypto-card hot-plug testing on a debug kernel. The CVSS vector describes a local, low-privilege attack surface; no remote attack path is identified.
Researcher notes
The demonstrated defect is CWE-416: zcrypt_card_put can release an object while another path still accesses it. Evidence shows slab corruption during AP bus removal and probing. The sources support memory corruption and high theoretical impact, but do not document a public exploit, reliable privilege escalation, or exploitation in production.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable Linux stable fix.
- Consult the operating-system vendor advisory for exact affected and fixed package versions.
- Prioritize s390 hosts and guests using zcrypt or hot-plugged cryptographic cards.
- Where patching is delayed, review whether crypto-card hot-plug operations can be safely restricted.
Validation and detection
- Inventory Linux s390 hosts and KVM guests using zcrypt-supported cryptographic cards.
- Compare installed kernel packages against vendor advisories and the referenced stable fixes.
- Review kernel logs for slab corruption, use-after-free reports, or zcrypt-related faults.
- After updating, confirm the running kernel includes the vendor backport or applicable stable commit.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-26957 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7e500849fa558879a1cde43f80c7c048c2437058CVE reference, Linux
- https://git.kernel.org/stable/c/9daddee03de3f231012014dab8ab2b277a116a55CVE reference, Linux
- https://git.kernel.org/stable/c/6470078ab3d8f222115e11c4ec67351f3031b3ddCVE reference, Linux
- https://git.kernel.org/stable/c/a55677878b93e9ebc31f66d0e2fb93be5e7836a6CVE reference, Linux
- https://git.kernel.org/stable/c/b7f6c3630eb3f103115ab0d7613588064f665d0dCVE reference, Linux
- https://git.kernel.org/stable/c/a64ab862e84e3e698cd351a87cdb504c7fc575caCVE reference, Linux
- https://git.kernel.org/stable/c/befb7f889594d23e1b475720cf93efd2f77df000CVE reference, Linux
- https://git.kernel.org/stable/c/394b6d8bbdf9ddee6d5bcf3e1f3e9f23eecd6484CVE reference, Linux
- https://git.kernel.org/stable/c/50ed48c80fecbe17218afed4f8bed005c802976cCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.