{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-26823","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-02-19T14:20:24.180Z","datePublished":"2024-04-17T09:43:49.850Z","dateUpdated":"2026-08-05T11:27:38.274Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:27:38.274Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v3-its: Restore quirk probing for ACPI-based systems\n\nWhile refactoring the way the ITSs are probed, the handling of quirks\napplicable to ACPI-based platforms was lost. As a result, systems such as\nHIP07 lose their GICv4 functionnality, and some other may even fail to\nboot, unless they are configured to boot with DT.\n\nMove the enabling of quirks into its_probe_one(), making it common to all\nfirmware implementations."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The flaw lives in ARM64 GICv3 ITS irqchip initialization and manifests through local ITS/MSI configuration and device probe; there is no network- or remote-facing input that reaches `its_probe_one()` or `its_create_device()`. Impact requires presence on the affected machine, so the vector is Local.\nAC:L - On any ACPI-booted system the quirk call is unconditionally absent from `gic_acpi_parse_madt_its()`, so every ITS is probed without its errata workarounds every boot — the defect is fully deterministic, involving no race, no memory-layout dependency, and no condition that must happen to align.\nPR:L - No authentication gate or capability check exists on the path — the ITS is misprogrammed during boot and the undersized-ITT overrun occurs through ordinary MSI/MSI-X allocation — but an actor must be locally present on the affected host; there is no unauthenticated remote or anonymous path.\nUI:N - The quirks are skipped automatically during early kernel init on every ACPI boot, and the resulting ITT undersizing and interrupt misdelivery occur during normal device probe with no victim action required.\nS:U - The out-of-bounds ITE writes, the misdirected VMAPP/VMOVP targeting, and the boot failure all occur within the kernel's own security authority; no IOMMU, hypervisor, or sandbox boundary is bypassed.\nC:H - The ITS writes 16-byte ITEs into a heap buffer sized for 8-byte entries, corrupting adjacent kernel objects; such heap corruption of neighboring pointer/length fields is leverageable for kernel memory disclosure, which the guidance scores as High.\nI:H - Losing the QDF2400 E0065 workaround re-introduces documented kernel memory corruption — the ITS DMA-writes ITEs past the end of the `kzalloc_node()`-allocated ITT into unrelated kernel heap — and the missing HIP07 `vlpi_redist_offset` makes the ITS target the wrong redistributor page.\nA:H - The commit states affected systems \"may even fail to boot\" and that HIP07 loses GICv4 entirely; combined with lost/misrouted interrupts on multi-socket ThunderX and heap corruption from the undersized ITT, the result is complete system unavailability."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/irqchip/irq-gic-v3-its.c"],"versions":[{"version":"9585a495ac936049dba141e8f9d99159ca06d46a","lessThan":"91a80fff3eeed928b6fba21271f6a9719b22a5d8","status":"affected","versionType":"git"},{"version":"9585a495ac936049dba141e8f9d99159ca06d46a","lessThan":"4c60c611441f1f1e5de8e00e98ee5a4970778a00","status":"affected","versionType":"git"},{"version":"9585a495ac936049dba141e8f9d99159ca06d46a","lessThan":"8b02da04ad978827e5ccd675acf170198f747a7a","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/irqchip/irq-gic-v3-its.c"],"versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","status":"unaffected","versionType":"semver"},{"version":"6.6.18","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.7.6","lessThanOrEqual":"6.7.*","status":"unaffected","versionType":"semver"},{"version":"6.8","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.18"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.7.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/91a80fff3eeed928b6fba21271f6a9719b22a5d8"},{"url":"https://git.kernel.org/stable/c/4c60c611441f1f1e5de8e00e98ee5a4970778a00"},{"url":"https://git.kernel.org/stable/c/8b02da04ad978827e5ccd675acf170198f747a7a"}],"title":"irqchip/gic-v3-its: Restore quirk probing for ACPI-based systems","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T00:14:13.578Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/91a80fff3eeed928b6fba21271f6a9719b22a5d8","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/4c60c611441f1f1e5de8e00e98ee5a4970778a00","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/8b02da04ad978827e5ccd675acf170198f747a7a","tags":["x_transferred"]}]},{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-26823","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T15:49:07.318138Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-11T17:33:32.102Z"}}]}}