CVE-2024-26650 - Vulnerability Details - OpenCVE

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 9
kernel-0:5.14.0-503.11.1.el9_5	cpe:/a:redhat:enterprise_linux:9	RHSA-2024:9315	2024-11-12T00:00:00Z
kernel-0:5.14.0-503.11.1.el9_5	cpe:/o:redhat:enterprise_linux:9	RHSA-2024:9315	2024-11-12T00:00:00Z

No data.

Project Subscriptions

Vendors	Products
Redhat Subscribe	Enterprise Linux Subscribe

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://lore.kernel.org/linux-cve-announce/20240326175007.1388794-18-lee@kernel.org/
https://nvd.nist.gov/vuln/detail/CVE-2024-26650
https://www.cve.org/CVERecord?id=CVE-2024-26650

History

Wed, 13 Nov 2024 02:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Redhat Redhat enterprise Linux
CPEs		cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Vendors & Products		Redhat Redhat enterprise Linux

Projects

Sign in to view the affected projects.

MITRE

Status: REJECTED

Assigner: Linux

Published: 2024-03-26T17:50:02.807Z

Updated: 2024-05-23T13:51:50.693Z

Reserved: 2024-02-19T14:20:24.139Z

Link: CVE-2024-26650

Vulnrichment

No data.

NVD

Status : Rejected

Published: 2024-03-26T18:15:10.530

Modified: 2024-05-23T14:15:09.293

Link: CVE-2024-26650

Redhat

Severity : Low

Publid Date: 2024-03-26T00:00:00Z

Links: CVE-2024-26650 - Bugzilla

OpenCVE Enrichment

No data.

Weaknesses

CWE-833

{"affected_release": [{"advisory": "RHSA-2024:9315", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}], "bugzilla": {"description": "kernel: p2sb_bar() calls during PCI device probe", "id": "2271795", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2271795"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-833", "details": ["[REJECTED CVE] A deadlock issue was identified in the Linux kernel within the platform/x86 P2SB subsystem. The issue arises when the p2sb_bar() function, used to unhide the P2SB device for resource retrieval, locks pci_rescan_remove_lock during PCI device probing. If a PCI bus rescan is triggered (e.g., via /sys/bus/pci/rescan), it can lead to a deadlock when the rescan also locks pci_rescan_remove_lock and probes devices that call p2sb_bar(). This deadlock could cause a system hang or unresponsiveness during PCI bus rescans or device probing, affecting system stability."], "name": "CVE-2024-26650", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-03-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26650\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26650\nhttps://lore.kernel.org/linux-cve-announce/20240326175007.1388794-18-lee@kernel.org/"], "statement": "This CVE has been rejected upstream:- https://lore.kernel.org/linux-cve-announce/2024052359-REJECTED-006a@gregkh/", "threat_severity": "Low"}