CVE-2024-26598
highpriority · track · 31EPSS 0.002 · 14 %ileDEEURUUSEPSS · scored 2026-10-24
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command. The root of the problem is that vgic_its_check_cache() does not elevate the refcount on the vgic_irq before dropping the lock that serializes refcount changes. Have vgic_its_check_cache() raise the refcount on the returned vgic_irq and add the corresponding decrement after queueing the interrupt.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (93)
Products and version ranges known to be affected.
- IBM Business Automation Workflow 24.0.0all versionscert_bundDEcpe:/a:ibm:business_automation_workflow:24.0.0
advisories (3)
Vendor and ecosystem advisories describing this.
- SSA-613116SSA-613116: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.12025-08-12csaf · siemens_psirtDE
SINEC OS before V3.1 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
- WID-SEC-W-2024-0475Linux-Kernel: Mehrere Schwachstellen ermöglichen Denial of Service und unspezifische AngriffeDeutsch2024-02-25csaf · cert_bundDE
Ein lokaler Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen oder einen nicht spezifizierten Angriff durchzuführen.
- ICSA-25-226-15Siemens SINEC OS2025-08-12icsa · cisa_csaf_otUS
SINEC OS before V3.1 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (26)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2024-26598cnnvd
- https://cxsecurity.com/cveshow/CVE-2024-26598/cnnvd
- https://git.kernel.org/stable/c/12c2759ab1343c124ed46ba48f27bd1ef5d2dff4cnnvd
- https://git.kernel.org/stable/c/65b201bf3e9af1b0254243a5881390eda56f72d1cnnvd
- https://git.kernel.org/stable/c/ad362fe07fecf0aba839ff2cc59a3617bd42c33fcnnvd
- https://git.kernel.org/stable/c/ba7be666740847d967822bed15500656b26bc703cnnvd
- https://git.kernel.org/stable/c/d04acadb6490aa3314f9c9e087691e55de153b88cnnvd
- https://git.kernel.org/stable/c/dba788e25f05209adf2b0175eb1691dc89fb1ba6cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan