CVE-2024-26974

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - resolve race condition during AER recovery During the PCI AER system's error recovery process, the kernel driver may encounter a race condition with freeing the reset_data structure's memory. If the device restart will take more than 10 seconds the function scheduling that restart will exit due to a timeout, and the reset_data structure will be freed. However, this data structure is used for completion notification after the restart is completed, which leads to a UAF bug. This results in a KFENCE bug notice. BUG: KFENCE: use-after-free read in adf_device_reset_worker+0x38/0xa0 [intel_qat] Use-after-free read at 0x00000000bc56fddf (in kfence-#142): adf_device_reset_worker+0x38/0xa0 [intel_qat] process_one_work+0x173/0x340 To resolve this race condition, the memory associated to the container of the work_struct is freed on the worker if the timeout expired, otherwise on the function that schedules the worker. The timeout detection can be done by checking if the caller is still waiting for completion or not by using completion_done() function.

• CWE-367
• CWE-416

• https://git.kernel.org/stable/c/0c2cf5142bfb634c0ef0a1a69cdf37950747d0bePatch
• https://git.kernel.org/stable/c/226fc408c5fcd23cc4186f05ea3a09a7a9aef2f7Patch
• https://git.kernel.org/stable/c/4ae5a97781ce7d6ecc9c7055396535815b64ca4fPatch
• https://git.kernel.org/stable/c/7d42e097607c4d246d99225bf2b195b6167a210cPatch
• https://git.kernel.org/stable/c/8a5a7611ccc7b1fba8d933a9f22a2e76859d94dcPatch
• https://git.kernel.org/stable/c/8e81cd58aee14a470891733181a47d123193ba81Patch
• https://git.kernel.org/stable/c/bb279ead42263e9fb09480f02a4247b2c287d828Patch
• https://git.kernel.org/stable/c/d03092550f526a79cf1ade7f0dfa74906f39eb71Patch
• https://git.kernel.org/stable/c/daba62d9eeddcc5b1081be7d348ca836c83c59d7Patch
• https://git.kernel.org/stable/c/0c2cf5142bfb634c0ef0a1a69cdf37950747d0bePatch
• https://git.kernel.org/stable/c/226fc408c5fcd23cc4186f05ea3a09a7a9aef2f7Patch
• https://git.kernel.org/stable/c/4ae5a97781ce7d6ecc9c7055396535815b64ca4fPatch
• https://git.kernel.org/stable/c/7d42e097607c4d246d99225bf2b195b6167a210cPatch
• https://git.kernel.org/stable/c/8a5a7611ccc7b1fba8d933a9f22a2e76859d94dcPatch
• https://git.kernel.org/stable/c/8e81cd58aee14a470891733181a47d123193ba81Patch
• https://git.kernel.org/stable/c/bb279ead42263e9fb09480f02a4247b2c287d828Patch
• https://git.kernel.org/stable/c/d03092550f526a79cf1ade7f0dfa74906f39eb71Patch
• https://git.kernel.org/stable/c/daba62d9eeddcc5b1081be7d348ca836c83c59d7Patch
• https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlMailing List, Third Party Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-265688.html

Published

May 1, 2024

Last Modified

Aug 4, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-26969In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-2697The socialdriver-framework WordPress plugin before 2024.0.0 …6.5
• CVE-2024-26970In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-26971In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-26972Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-26973In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-26975In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-26976In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-26977In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-26978In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-26979Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-2698A vulnerability was found in FreeIPA in how the initial impl…8.8