Security readout for executives and security teams
Plain-English summary
CVE-2024-26999 is a Linux kernel reliability flaw in the pmac_zilog serial driver. A mitigation for receive-interrupt flooding can itself cause a crash when pmac_zilog is used as the serial console. This mainly threatens availability on systems that use this older, hardware-specific driver.
Executive priority
Handle through normal kernel patch management unless the organization depends on affected PowerMac/Zilog serial console paths. For most environments, urgency is low because exposure is narrow and no active exploitation is cited.
Technical view
The vulnerable code logs an rx interrupt flood from pmz_receive_chars(). That can recurse into pmz_console_write() while pmz_interrupt() already holds the uart_port spinlock. With CONFIG_DEBUG_SPINLOCK, this triggers a fatal spinlock recursion BUG; without it, receive handling may stop working.
Likely exposure
Exposure appears limited to Linux systems using the pmac_zilog serial driver, especially where it is configured as a serial console. The CVE data lists Linux kernel versions across older and supported stable branches as affected, with stable kernel commits and Debian/Fedora advisories referenced for fixes.
Exploitation context
The source bundle does not show active exploitation, KEV listing, public exploit code, or broad real-world reports. The kernel note says a web search found no other reports of the pmz rx irq flood message. Treat this as a niche availability issue unless local hardware and console configuration make it operationally important.
Researcher notes
The key condition is the interaction between pmz_receive_chars(), pr_err(), pmz_console_write(), and uart_port locking during interrupt handling. The fix removes the flawed rx irq flood mitigation rather than adding a new runtime guard. Evidence is strongest for availability impact, not privilege escalation or data compromise.
Mitigation direction
- Update to a fixed kernel from Linux stable or your distribution vendor.
- Prioritize Debian and Fedora hosts covered by their published kernel advisories.
- Identify systems using pmac_zilog before treating this as fleet-wide exposure.
- Avoid relying on pmac_zilog as a serial console until patched, where operationally feasible.
- If no vendor patch is available, follow vendor guidance for supported workarounds.
Validation and detection
- Inventory running kernel versions against the CVE affected version data.
- Check whether pmac_zilog is built, loaded, or used for serial console access.
- Review boot and console configuration for ttyPZ or pmz-related usage.
- Confirm the relevant Linux stable fix is included in deployed kernel packages.
- Monitor kernel logs for pmz rx irq flood or spinlock recursion messages.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-26999 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/69a02273e288011b521ee7c1f3ab2c23fda633ceCVE reference, Linux
- https://git.kernel.org/stable/c/d679c816929d62af51c8e6d7fc0e165c9412d2f3CVE reference, Linux
- https://git.kernel.org/stable/c/ab86cf6f8d24e63e9aca23da5108af1aa5483928CVE reference, Linux
- https://git.kernel.org/stable/c/7a3bbe41efa55323b6ea3c35fa15941d4dbecdefCVE reference, Linux
- https://git.kernel.org/stable/c/bbaafbb4651fede8d3c3881601ecaa4f834f9d3fCVE reference, Linux
- https://git.kernel.org/stable/c/52aaf1ff14622a04148dbb9ccce6d9de5d534ea7CVE reference, Linux
- https://git.kernel.org/stable/c/ca09dfc3cfdf89e6af3ac24e1c6c0be5c575a729CVE reference, Linux
- https://git.kernel.org/stable/c/1be3226445362bfbf461c92a5bcdb1723f2e4907CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/CVE reference, CVE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/CVE reference, CVE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/CVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.