CVE-2024-26796— drivers: perf: ctr_get_width function for legacy is not defined
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-26796
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
drivers: perf: ctr_get_width function for legacy is not defined
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: drivers: perf: ctr_get_width function for legacy is not defined With parameters CONFIG_RISCV_PMU_LEGACY=y and CONFIG_RISCV_PMU_SBI=n linux kernel crashes when you try perf record: $ perf record ls [ 46.749286] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 46.750199] Oops [#1] [ 46.750342] Modules linked in: [ 46.750608] CPU: 0 PID: 107 Comm: perf-exec Not tainted 6.6.0 #2 [ 46.750906] Hardware name: riscv-virtio,qemu (DT) [ 46.751184] epc : 0x0 [ 46.751430] ra : arch_perf_update_userpage+0x54/0x13e [ 46.751680] epc : 0000000000000000 ra : ffffffff8072ee52 sp : ff2000000022b8f0 [ 46.751958] gp : ffffffff81505988 tp : ff6000000290d400 t0 : ff2000000022b9c0 [ 46.752229] t1 : 0000000000000001 t2 : 0000000000000003 s0 : ff2000000022b930 [ 46.752451] s1 : ff600000028fb000 a0 : 0000000000000000 a1 : ff600000028fb000 [ 46.752673] a2 : 0000000ae2751268 a3 : 00000000004fb708 a4 : 0000000000000004 [ 46.752895] a5 : 0000000000000000 a6 : 000000000017ffe3 a7 : 00000000000000d2 [ 46.753117] s2 : ff600000028fb000 s3 : 0000000ae2751268 s4 : 0000000000000000 [ 46.753338] s5 : ffffffff8153e290 s6 : ff600000863b9000 s7 : ff60000002961078 [ 46.753562] s8 : ff60000002961048 s9 : ff60000002961058 s10: 0000000000000001 [ 46.753783] s11: 0000000000000018 t3 : ffffffffffffffff t4 : ffffffffffffffff [ 46.754005] t5 : ff6000000292270c t6 : ff2000000022bb30 [ 46.754179] status: 0000000200000100 badaddr: 0000000000000000 cause: 000000000000000c [ 46.754653] Code: Unable to access instruction at 0xffffffffffffffec. [ 46.754939] ---[ end trace 0000000000000000 ]--- [ 46.755131] note: perf-exec[107] exited with irqs disabled [ 46.755546] note: perf-exec[107] exited with preempt_count 4 This happens because in the legacy case the ctr_get_width function was not defined, but it is used in arch_perf_update_userpage. Also remove extra check in riscv_pmu_ctr_get_width_mask
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于驱动程序 perf 中的 ctr_get_width 函数存在安全问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-26796
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-26796
请登录查看更多情报信息。
Same Patch Batch · Linux · 2024-04-04 · 32 CVEs total
| CVE-2024-26792 | btrfs: fix double free of anonymous device after snapshot creation failure | |
| CVE-2024-26809 | netfilter: nft_set_pipapo: release elements in clone only from destroy path | |
| CVE-2024-26808 | netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain | |
| CVE-2024-26807 | spi: cadence-qspi: fix pointer reference in runtime PM hooks | |
| CVE-2024-26806 | spi: cadence-qspi: remove system-wide suspend helper calls from runtime PM hooks | |
| CVE-2024-26805 | netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter | |
| CVE-2024-26804 | net: ip_tunnel: prevent perpetual headroom growth | |
| CVE-2024-26803 | net: veth: clear GRO when clearing XDP even when down | |
| CVE-2024-26802 | stmmac: Clear variable when destroying workqueue | |
| CVE-2024-26800 | tls: fix use-after-free on failed backlog decryption | |
| CVE-2024-26801 | Bluetooth: Avoid potential use-after-free in hci_error_reset | |
| CVE-2024-26799 | ASoC: qcom: Fix uninitialized pointer dmactl | |
| CVE-2024-26798 | fbcon: always restore the old font data in fbcon_do_set_font() | |
| CVE-2024-26797 | drm/amd/display: Prevent potential buffer overflow in map_hw_resources | |
| CVE-2024-26795 | riscv: Sparse-Memory/vmemmap out-of-bounds fix | |
| CVE-2024-26793 | gtp: fix use-after-free and null-ptr-deref in gtp_newlink() | |
| CVE-2024-26745 | powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV | |
| CVE-2024-26791 | btrfs: dev-replace: properly validate device names | |
| CVE-2024-26790 | dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read | |
| CVE-2024-26789 | crypto: arm64/neonbs - fix out-of-bounds access on short input |
Showing top 20 of 32 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
Same vendor: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
V. Comments for CVE-2024-26796
No comments yet