CVE-2024-26601

mediumpriority · track · 22EPSS 0.003 · 22 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.29% (22nd) EPSS

CVSS 5.5 · medium

Is it mine?

87 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

In the Linux kernel, the following vulnerability has been resolved: ext4: regenerate buddy after block freeing failed if under fc replay This mostly reverts commit 6bd97bf273bd ("ext4: remove redundant mb_regenerate_buddy()") and reintroduces mb_regenerate_buddy(). Based on code in mb_free_blocks(), fast commit replay can end up marking as free blocks that are already marked as such. This causes corruption of the buddy bitmap so we need to regenerate it in that case.

cvss

Technical severity, 0–10. One row per scoring source.

7.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.1–7.8

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 1.8 · impact 3.6

v3.15.5mediumAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 1.8 · impact 5.9

v3.15.1mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-362USCWE-416US

affected products (87)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Broadcom Brocade SANnavall versionscert_bundDEcpe:/a:broadcom:brocade_sannav:-
Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Dell NetWorkerall versionscert_bundDEcpe:/a:dell:networker:-
Dell NetWorker virtualall versionscert_bundDEcpe:/a:dell:networker:virtual
EMC Avamarall versionscert_bundDEcpe:/a:emc:avamar:-
F5 BIG-IPall versionscert_bundDEcpe:/a:f5:big-ip:-
IBM Business Automation Workflow 24.0.0all versionscert_bundDEcpe:/a:ibm:business_automation_workflow:24.0.0
IBM DB2 on Cloud Pak for Dataall versionscert_bundDEcpe:/a:ibm:db2:on_cloud_pak_for_data
IBM InfoSphere Guardiumall versionscert_bundDEcpe:/a:ibm:infosphere_guardium:-
IBM QRadar SIEMall versionscert_bundDEcpe:/a:ibm:qradar_siem:-
IBM Security Guardium 11.4all versionscert_bundDEcpe:/a:ibm:security_guardium:11.4
IBM Security Guardium 11.5all versionscert_bundDEcpe:/a:ibm:security_guardium:11.5
IBM Security Guardium 12.0all versionscert_bundDEcpe:/a:ibm:security_guardium:12.0
IBM Spectrum Protect Plus 10.1all versionscert_bundDEcpe:/a:ibm:spectrum_protect_plus:10.1
IBM Spectrum Protect Plus <10.1.6.4all versionscert_bundDE
IBM Storage Scale System <6.1.9.7all versionscert_bundDE
IBM Storage Scale System <6.2.3.0all versionscert_bundDE
Insyde UEFI Firmware kernelall versionscert_bundDEcpe:/h:insyde:uefi:kernel
Open Source Linux Kernelall versionscert_bundDEcpe:/o:linux:linux_kernel:-

showing 20 of 87

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-0475Linux-Kernel: Mehrere Schwachstellen ermöglichen Denial of Service und unspezifische AngriffeDeutsch2024-02-25csaf · cert_bundDE
Ein lokaler Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen oder einen nicht spezifizierten Angriff durchzuführen.
WID-SEC-W-2024-1913Red Hat OpenShift Container Platform: Mehrere SchwachstellenDeutsch2024-08-22csaf · cert_bundDE
Ein entfernter anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Container Platform ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen, Dateien und Daten zu manipulieren oder Sicherheitsmaßnahmen zu umgehen.
WID-SEC-W-2025-1293IBM DataPower Gateway: Mehrere SchwachstellenDeutsch2025-06-10csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM DataPower Gateway ausnutzen, um seine Privilegien zu erhöhen, Informationen auszuspähen, einen Denial-of-Service auszulösen oder weitere unspezifizierte Auswirkungen zu erzielen.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund NVD CVE.org MITRE

published 2024-02-26modified 2026-08-04

references (20)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan