In the Linux kernel, the following vulnerability has been resolved:

init/main.c: Fix potential static_command_line memory overflow

We allocate memory of size 'xlen + strlen(boot_command_line) + 1' for
static_command_line, but the strings copied into static_command_line are
extra_command_line and command_line, rather than extra_command_line and
boot_command_line.

When strlen(command_line) > strlen(boot_command_line), static_command_line
will overflow.

This patch just recovers strlen(command_line) which was miss-consolidated
with strlen(boot_command_line) in the commit f5c7310ac73e ("init/main: add
checks for the return value of memblock_alloc*()")

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00012.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
f5c7310ac73ea270e3a1acdb73d1b4817f11fd67 affected
< 2ef607ea103616aec0289f1b65d103d499fa903a
f5c7310ac73ea270e3a1acdb73d1b4817f11fd67 affected
< 0dc727a4e05400205358a22c3d01ccad2c8e1fe4
f5c7310ac73ea270e3a1acdb73d1b4817f11fd67 affected
< 76c2f4d426a5358fced5d5990744d46f10a4ccea
f5c7310ac73ea270e3a1acdb73d1b4817f11fd67 affected
< 81cf85ae4f2dd5fa3e43021782aa72c4c85558e8
f5c7310ac73ea270e3a1acdb73d1b4817f11fd67 affected
< 936a02b5a9630c5beb0353c3085cc49d86c57034
f5c7310ac73ea270e3a1acdb73d1b4817f11fd67 affected
< 46dad3c1e57897ab9228332f03e1c14798d2d3b9
Linux Linux affected
Version Status Constraints
5.1 affected
—
0 unaffected
< 5.1
5.10.216 unaffected
≤ 5.10.*
5.15.157 unaffected
≤ 5.15.*
6.1.88 unaffected
≤ 6.1.*
6.6.29 unaffected
≤ 6.6.*
6.8.8 unaffected
≤ 6.8.*
6.9 unaffected
≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 3 [-]

OR cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 9
kernel-0:5.14.0-503.11.1.el9_5 cpe:/a:redhat:enterprise_linux:9 RHSA-2024:9315 2024-11-12T00:00:00Z
kernel-0:5.14.0-503.11.1.el9_5 cpe:/o:redhat:enterprise_linux:9 RHSA-2024:9315 2024-11-12T00:00:00Z

No data.

Subscriptions

Vendors Products
Debian Subscribe
Debian Linux Subscribe
Fedoraproject Subscribe
Fedora Subscribe
Linux Subscribe
Linux Kernel Subscribe
Redhat Subscribe
Enterprise Linux Subscribe

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-3842-1 linux-5.10 security update
Debian DSA Debian DSA DSA-5680-1 linux security update
Debian DSA Debian DSA DSA-5681-1 linux security update
Ubuntu USN Ubuntu USN USN-6893-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-6893-2 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-6893-3 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-6898-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-6898-2 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-6898-3 Linux kernel kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-6898-4 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-6917-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-6918-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-6919-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-6927-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7019-1 Linux kernel vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0dc727a4e05400205358a22c3d01ccad2c8e1fe4 cve-icon cve-icon
https://git.kernel.org/stable/c/2ef607ea103616aec0289f1b65d103d499fa903a cve-icon cve-icon
https://git.kernel.org/stable/c/46dad3c1e57897ab9228332f03e1c14798d2d3b9 cve-icon cve-icon
https://git.kernel.org/stable/c/76c2f4d426a5358fced5d5990744d46f10a4ccea cve-icon cve-icon
https://git.kernel.org/stable/c/81cf85ae4f2dd5fa3e43021782aa72c4c85558e8 cve-icon cve-icon
https://git.kernel.org/stable/c/936a02b5a9630c5beb0353c3085cc49d86c57034 cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/ cve-icon
https://lore.kernel.org/linux-cve-announce/2024050143-CVE-2024-26988-c304@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-26988 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-26988 cve-icon
History

Tue, 23 Dec 2025 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Debian
Debian debian Linux
Fedoraproject
Fedoraproject fedora
Linux
Linux linux Kernel
Weaknesses CWE-787
CPEs cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
Vendors & Products Debian
Debian debian Linux
Fedoraproject
Fedoraproject fedora
Linux
Linux linux Kernel
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Tue, 04 Nov 2025 18:30:00 +0000

Type Values Removed Values Added
References

Thu, 19 Dec 2024 09:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 13 Nov 2024 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/a:redhat:enterprise_linux:9
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux

Thu, 12 Sep 2024 08:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 11 Sep 2024 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-11-04T17:15:27.644Z

Reserved: 2024-02-19T14:20:24.205Z

Link: CVE-2024-26988

cve-icon Vulnrichment

Updated: 2025-11-04T17:15:27.644Z

cve-icon NVD

Status : Analyzed

Published: 2024-05-01T06:15:16.420

Modified: 2025-12-23T00:50:13.600

Link: CVE-2024-26988

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-05-01T00:00:00Z

Links: CVE-2024-26988 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses