CVE-2024-26926
mediumpriority · track · 22EPSS 0.004 · 38 %ileDEEUNLRUUSEPSS · scored 2026-10-27
In the Linux kernel, the following vulnerability has been resolved: binder: check offset alignment in binder_get_object() Commit 6d98eb95b450 ("binder: avoid potential data leakage when copying txn") introduced changes to how binder objects are copied. In doing so, it unintentionally removed an offset alignment check done through calls to binder_alloc_copy_from_buffer() -> check_buffer(). These calls were replaced in binder_get_object() with copy_from_user(), so now an explicit offset alignment check is needed here. This avoids later complications when unwinding the objects gets harder. It is worth noting this check existed prior to commit 7a67a39320df ("binder: add function to copy binder object from buffer"), likely removed due to redundancy at the time.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedRUGGEDCOM RST2428P (6GK6242-6PA00)siemens_psirt
Update to V3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109977557/ - FixedSCALANCE XCM-/XRM-/XCH-/XRH-300 familysiemens_psirt
Update to V3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109977557/ - FixedRUGGEDCOM RST2428P (6GK6242-6PA00)cisa_csaf_ot
Update to V3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109977557/ - FixedSCALANCE XCM-/XRM-/XCH-/XRH-300 familycisa_csaf_ot
Update to V3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109977557/
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · none–high · 0–7.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (85)
Products and version ranges known to be affected.
advisories (6)
Vendor and ecosystem advisories describing this.
- NCSC-2024-0240Kwetsbaarheden verholpen in Google Android en Samsung MobileNL2024-06-07csaf · ncsc_nlNL
Google heeft kwetsbaarheden verholpen in Android.
- SSA-613116SSA-613116: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.12025-08-12csaf · siemens_psirtDE
SINEC OS before V3.1 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
- WID-SEC-W-2024-0964Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffDeutsch2024-04-24csaf · cert_bundDE
Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- WID-SEC-W-2024-1278Android Patchday - June 2024: Mehrere SchwachstellenDeutsch2024-06-03csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen, um vertrauliche Informationen offenzulegen und um einen Denial-of-Service-Zustand zu erzeugen.
- ICSA-25-226-15Siemens SINEC OS2025-08-12icsa · cisa_csaf_otUS
SINEC OS before V3.1 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
- ASB-A-3206610882024-06-01vendor · osvUS
In binder_alloc_copy_to_buffer of binder.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (18)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2024-26926cnnvd
- https://cxsecurity.com/cveshow/CVE-2024-26926/cnnvd
- https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40cnnvd
- https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdcenisa_euvd
- https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fcenisa_euvd
- https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12enisa_euvd
- https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115cenisa_euvd
- https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan