{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2024-26841 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2024-26841 is a medium-severity denial of service vulnerability in Linux kernel, published on 17 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-26841 and fix it if it is affected.\n\nWhat it is: CVE-2024-26841 is a medium-severity denial of service vulnerability in Linux kernel, published on 17 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-26841 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-26841/ (Markdown: https://insights.sbomify.com/CVE-2024-26841/index.md)","id":"CVE-2024-26841","markdown":"https://insights.sbomify.com/CVE-2024-26841/index.md","name":"CVE-2024-26841","record":{"aliases":["AZL-59453","BELL-CVE-2024-26841","DEBIAN-CVE-2024-26841","GHSA-q744-2548-mr5h","ROOT-OS-DEBIAN-12-CVE-2024-26841","UBUNTU-CVE-2024-26841"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A bug in the Linux kernel LoongArch architecture causes a kernel warning and potential instability when disabling nonboot CPUs on SMT systems.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-459","name":"Incomplete Cleanup"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Update cpu_sibling_map when disabling nonboot CPUs\n\nUpdate cpu_sibling_map when disabling nonboot CPUs by defining \u0026 calling\nclear_cpu_sibling_map(), otherwise we get such errors on SMT systems:\n\njump label: negative count!\nWARNING: CPU: 6 PID: 45 at kernel/jump_label.c:263 __static_key_slow_dec_cpuslocked+0xec/0x100\nCPU: 6 PID: 45 Comm: cpuhp/6 Not tainted 6.8.0-rc5+ #1340\npc 90000000004c302c ra 90000000004c302c tp 90000001005bc000 sp 90000001005bfd20\na0 000000000000001b a1 900000000224c278 a2 90000001005bfb58 a3 900000000224c280\na4 900000000224c278 a5 90000001005bfb50 a6 0000000000000001 a7 0000000000000001\nt0 ce87a4763eb5234a t1 ce87a4763eb5234a t2 0000000000000000 t3 0000000000000000\nt4 0000000000000006 t5 0000000000000000 t6 0000000000000064 t7 0000000000001964\nt8 000000000009ebf6 u0 9000000001f2a068 s9 0000000000000000 s0 900000000246a2d8\ns1 ffffffffffffffff s2 ffffffffffffffff s3 90000000021518c0 s4 0000000000000040\ns5 9000000002151058 s6 9000000009828e40 s7 00000000000000b4 s8 0000000000000006\n   ra: 90000000004c302c __static_key_slow_dec_cpuslocked+0xec/0x100\n  ERA: 90000000004c302c __static_key_slow_dec_cpuslocked+0xec/0x100\n CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)\n PRMD: 00000004 (PPLV0 +PIE -PWE)\n EUEN: 00000000 (-FPE -SXE -ASXE -BTE)\n ECFG: 00071c1c (LIE=2-4,10-12 VS=7)\nESTAT: 000c0000 [BRK] (IS= ECode=12 EsubCode=0)\n PRID: 0014d000 (Loongson-64bit, Loongson-3A6000-HV)\nCPU: 6 PID: 45 Comm: cpuhp/6 Not tainted 6.8.0-rc5+ #1340\nStack : 0000000000000000 900000000203f258 900000000179afc8 90000001005bc000\n        90000001005bf980 0000000000000000 90000001005bf988 9000000001fe0be0\n        900000000224c280 900000000224c278 90000001005bf8c0 0000000000000001\n        0000000000000001 ce87a4763eb5234a 0000000007f38000 90000001003f8cc0\n        0000000000000000 0000000000000006 0000000000000000 4c206e6f73676e6f\n        6f4c203a656d616e 000000000009ec99 0000000007f38000 0000000000000000\n        900000000214b000 9000000001fe0be0 0000000000000004 0000000000000000\n        0000000000000107 0000000000000009 ffffffffffafdabe 00000000000000b4\n        0000000000000006 90000000004c302c 9000000000224528 00005555939a0c7c\n        00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c\n        ...\nCall Trace:\n[\u003c9000000000224528\u003e] show_stack+0x48/0x1a0\n[\u003c900000000179afc8\u003e] dump_stack_lvl+0x78/0xa0\n[\u003c9000000000263ed0\u003e] __warn+0x90/0x1a0\n[\u003c90000000017419b8\u003e] report_bug+0x1b8/0x280\n[\u003c900000000179c564\u003e] do_bp+0x264/0x420\n[\u003c90000000004c302c\u003e] __static_key_slow_dec_cpuslocked+0xec/0x100\n[\u003c90000000002b4d7c\u003e] sched_cpu_deactivate+0x2fc/0x300\n[\u003c9000000000266498\u003e] cpuhp_invoke_callback+0x178/0x8a0\n[\u003c9000000000267f70\u003e] cpuhp_thread_fun+0xf0/0x240\n[\u003c90000000002a117c\u003e] smpboot_thread_fn+0x1dc/0x2e0\n[\u003c900000000029a720\u003e] kthread+0x140/0x160\n[\u003c9000000000222288\u003e] ret_from_kernel_thread+0xc/0xa4","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"LoongArch: Update cpu_sibling_map when disabling nonboot CPUs","id":"CVE-2024-26841","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"denial_of_service","year":"2024"},"n_packages":0,"n_references":3,"next":{"headline":"scsi: ufs: core: Fix shift issue in ufshcd_clear_cmd()","id":"CVE-2024-26842"},"packages":[],"prev":{"headline":"cachefiles: fix memory leak in cachefiles_add_cache()","id":"CVE-2024-26840"},"products":["Linux"],"published":"2024-04-17","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A bug in the Linux kernel LoongArch architecture causes a kernel warning and potential instability when disabling nonboot CPUs on SMT systems.","url":"https://insights.sbomify.com/CVE-2024-26841/"}