CVE-2024-26824
crypto: algif_hash - Remove bogus SGL free on zero-length error path
MEDIUM 5.5EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_hash - Remove bogus SGL free on zero-length error path When a zero-length message is hashed by algif_hash, and an error is triggered, it tries to free an SG list that was never allocated in the first place. Fix this by not freeing the SG list on the zero-length error path.
- Affected
- Linux
- CVSS v3.1 NVD
- 5.5 MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS v3.1 CNA
- 7.8 HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- 0.24% chance of exploitation in the next 30 days, 14th percentile
- Published
- 2024-04-17
- Updated
- 2026-08-05
Exploit collections (1)
- linux/kernelctf/CVE-2024-26824_mitigationgoogle/security-research
Security advisories
- https://git.kernel.org/stable/c/24c890dd712f6345e382256cae8c97abb0406b70
- https://git.kernel.org/stable/c/775f3c1882a493168e08fdb8cde0865c8f3a8a29
- https://git.kernel.org/stable/c/9c82920359b7c1eddaf72069bcfe0ffddf088cd0