CVE-2024-26664 – This CVE-2024-26664 is an out-of-bounds memory ... (How to Fix)

Q: What is the severity of CVE-2024-26664?

CVE-2024-26664 has a CVSS score of 7.1 (HIGH). This CVE-2024-26664 is an out-of-bounds memory access vulnerability in the Linux kernel's coretemp hardware monitoring driver. It allows attackers with local access to potentially crash the system or execute arbitrary code by triggering the bug on systems with more than 128 cores per CPU package. All Linux systems using the affected kernel versions with coretemp enabled are vulnerable.

📋 TL;DR

This CVE-2024-26664 is an out-of-bounds memory access vulnerability in the Linux kernel's coretemp hardware monitoring driver. It allows attackers with local access to potentially crash the system or execute arbitrary code by triggering the bug on systems with more than 128 cores per CPU package. All Linux systems using the affected kernel versions with coretemp enabled are vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected kernel versions not explicitly stated in CVE; typically affects versions before the fix commits listed in references.

Operating Systems: All Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with more than 128 cores per CPU package where coretemp driver is loaded/enabled. Coretemp is commonly enabled by default for hardware temperature monitoring.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to kernel-level code execution, potentially leading to full system compromise, data theft, or persistent backdoor installation.

🟠

Likely Case

Kernel panic or system crash causing denial of service, requiring physical or remote console access to reboot.

🟢

If Mitigated

No impact if systems are patched or coretemp module is disabled/unloaded.

🌐 Internet-Facing: LOW - Requires local access to the system; not directly exploitable over network.

🏢 Internal Only: MEDIUM - Local attackers or compromised user accounts could exploit this for privilege escalation or DoS attacks.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to trigger the specific condition on high-core-count systems. No public exploits known at this time.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 1eb74c00c9c3b13cb65e508c5d5a2f11afb96b8b, 3a7753bda55985dc26fae17795cb10d825453ad1, 4e440abc894585a34c2904a32cd54af1742311b3, 853a6503c586a71abf27e60a7f8c4fb28092976d, 93f0f4e846fcb682c3ec436e3b2e30e5a3a8ee6a

Vendor Advisory: https://git.kernel.org/stable/c/1eb74c00c9c3b13cb65e508c5d5a2f11afb96b8b

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable coretemp module

linux

Unload or blacklist the coretemp kernel module to prevent vulnerability exploitation

sudo rmmod coretemp
echo 'blacklist coretemp' | sudo tee /etc/modprobe.d/blacklist-coretemp.conf

🧯 If You Can't Patch

Restrict local access to systems with high core counts
Implement strict privilege separation and monitor for suspicious local activity

🔍 How to Verify

Check if Vulnerable:

Check if coretemp module is loaded and system has >128 cores per package: lsmod | grep coretemp && lscpu | grep 'Core(s) per socket'

Check Version:

uname -r

Verify Fix Applied:

Check kernel version against patched versions from your distribution's security advisories

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages
System crashes/panics
Unexpected coretemp module errors in dmesg

Network Indicators:

None - local vulnerability only

SIEM Query:

Search for: 'kernel: BUG:', 'kernel: Oops:', 'coretemp' in system logs

📊 Metadata

CVE ID: CVE-2024-26664

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-787

Published: April 2, 2024

Last Updated: March 17, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-26664, you might also want to check these: