CVE-2024-26877
mediumpriority · track · 22EPSS 0.007 · 54 %ileDEEURUUSEPSS · scored 2026-10-27
In the Linux kernel, the following vulnerability has been resolved: crypto: xilinx - call finalize with bh disabled When calling crypto_finalize_request, BH should be disabled to avoid triggering the following calltrace: ------------[ cut here ]------------ WARNING: CPU: 2 PID: 74 at crypto/crypto_engine.c:58 crypto_finalize_request+0xa0/0x118 Modules linked in: cryptodev(O) CPU: 2 PID: 74 Comm: firmware:zynqmp Tainted: G O 6.8.0-rc1-yocto-standard #323 Hardware name: ZynqMP ZCU102 Rev1.0 (DT) pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : crypto_finalize_request+0xa0/0x118 lr : crypto_finalize_request+0x104/0x118 sp : ffffffc085353ce0 x29: ffffffc085353ce0 x28: 0000000000000000 x27: ffffff8808ea8688 x26: ffffffc081715038 x25: 0000000000000000 x24: ffffff880100db00 x23: ffffff880100da80 x22: 0000000000000000 x21: 0000000000000000 x20: ffffff8805b14000 x19: ffffff880100da80 x18: 0000000000010450 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000003 x13: 0000000000000000 x12: ffffff880100dad0 x11: 0000000000000000 x10: ffffffc0832dcd08 x9 : ffffffc0812416d8 x8 : 00000000000001f4 x7 : ffffffc0830d2830 x6 : 0000000000000001 x5 : ffffffc082091000 x4 : ffffffc082091658 x3 : 0000000000000000 x2 : ffffffc7f9653000 x1 : 0000000000000000 x0 : ffffff8802d20000 Call trace: crypto_finalize_request+0xa0/0x118 crypto_finalize_aead_request+0x18/0x30 zynqmp_handle_aes_req+0xcc/0x388 crypto_pump_work+0x168/0x2d8 kthread_worker_fn+0xfc/0x3a0 kthread+0x118/0x138 ret_from_fork+0x10/0x20 irq event stamp: 40 hardirqs last enabled at (39): [<ffffffc0812416f8>] _raw_spin_unlock_irqrestore+0x70/0xb0 hardirqs last disabled at (40): [<ffffffc08122d208>] el1_dbg+0x28/0x90 softirqs last enabled at (36): [<ffffffc080017dec>] kernel_neon_begin+0x8c/0xf0 softirqs last disabled at (34): [<ffffffc080017dc0>] kernel_neon_begin+0x60/0xf0 ---[ end trace 0000000000000000 ]---
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSIMATIC S7-1500 TM MFP - GNU/Linux subsystemsiemens_psirt
Update to V1.1.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109827684/ - MitigationSIMATIC S7-1500 TM MFP - GNU/Linux subsystemsiemens_psirt
Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.
- MitigationSIMATIC S7-1500 TM MFP - GNU/Linux subsystemcisa_csaf_ot
Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.
- No fix availableSIMATIC S7-1500 TM MFP - GNU/Linux subsystemcisa_csaf_ot
Currently no fix is available
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–critical · 3.3–9.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (74)
Products and version ranges known to be affected.
- IBM Business Automation Workflow 24.0.0all versionscert_bundDEcpe:/a:ibm:business_automation_workflow:24.0.0
- NetApp ActiveIQ Unified Manager for VMware vSphereall versionscert_bundDEcpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere
advisories (3)
Vendor and ecosystem advisories describing this.
- SSA-265688SSA-265688: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.12024-04-09csaf · siemens_psirtDE
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1. Siemens has released a new version for SIMATIC S7-1500 TM MFP - GNU/Linux subsystem and recommends to update to the latest version. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available. SIMATIC S7-1500 TM MFP V1.1 is no longer maintained and there won't be any update to the CVE list anymore. Please update to the latest version. Note: This SSA advises vulnerabilities for firmware version V1.1 only; for version V1.1.1 refer to SSA-784472.
- WID-SEC-W-2024-0920Linux Kernel: Mehrere SchwachstellenDeutsch2024-04-17csaf · cert_bundDE
Ein lokaler Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen oder einen nicht spezifizierten Angriff durchzuführen.
- ICSA-24-102-01Siemens SIMATIC S7-1500 TM MFP2024-04-09icsa · cisa_csaf_otUS
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (26)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2024-26877cnnvd
- https://cxsecurity.com/cveshow/CVE-2024-26877/cnnvd
- https://git.kernel.org/stable/c/03e6d4e948432a61b35783323b6ab2be071d2619cnnvd
- https://git.kernel.org/stable/c/23bc89fdce71124cd2126fc919c7076e7cb489cfcnnvd
- https://git.kernel.org/stable/c/8a01335aedc50a66d04dd39203c89f4bc8042596cnnvd
- https://git.kernel.org/stable/c/9db89b1fb85557892e6681724b367287de5f9f20cnnvd
- https://git.kernel.org/stable/c/a71f66bd5f7b9b35a8aaa49e29565eca66299399cnnvd
- https://git.kernel.org/stable/c/a853450bf4c752e664abab0b2fad395b7ad7701ccnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan