VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Apr 17, 2024· Updated May 12, 2026

CVE-2024-26870

CVE-2024-26870

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102

A call to listxattr() with a buffer size = 0 returns the actual size of the buffer needed for a subsequent call. When size > 0, nfs4_listxattr() does not return an error because either generic_listxattr() or nfs4_listxattr_nfs4_label() consumes exactly all the bytes then size is 0 when calling nfs4_listxattr_nfs4_user() which then triggers the following kernel BUG:

[ 99.403778] kernel BUG at mm/usercopy.c:102! [ 99.404063] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 99.408463] CPU: 0 PID: 3310 Comm: python3 Not tainted 6.6.0-61.fc40.aarch64 #1 [ 99.415827] Call trace: [ 99.415985] usercopy_abort+0x70/0xa0 [ 99.416227] __check_heap_object+0x134/0x158 [ 99.416505] check_heap_object+0x150/0x188 [ 99.416696] __check_object_size.part.0+0x78/0x168 [ 99.416886] __check_object_size+0x28/0x40 [ 99.417078] listxattr+0x8c/0x120 [ 99.417252] path_listxattr+0x78/0xe0 [ 99.417476] __arm64_sys_listxattr+0x28/0x40 [ 99.417723] invoke_syscall+0x78/0x100 [ 99.417929] el0_svc_common.constprop.0+0x48/0xf0 [ 99.418186] do_el0_svc+0x24/0x38 [ 99.418376] el0_svc+0x3c/0x110 [ 99.418554] el0t_64_sync_handler+0x120/0x130 [ 99.418788] el0t_64_sync+0x194/0x198 [ 99.418994] Code: aa0003e3 d000a3e0 91310000 97f49bdb (d4210000)

Issue is reproduced when generic_listxattr() returns 'system.nfs4_acl', thus calling lisxattr() with size = 16 will trigger the bug.

Add check on nfs4_listxattr() to return ERANGE error when it is called with size > 0 and the return value is greater than size.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

NFSv4.2 listxattr bug causes kernel BUG due to size miscalculation, enabling local denial of service.

Vulnerability

In the Linux kernel, the nfs4_listxattr function for NFSv4.2 incorrectly handles buffer size when listing extended attributes. When listxattr is called with a buffer size greater than zero, and previous handlers consume exactly all bytes, the subsequent call to nfs4_listxattr_nfs4_user is made with a size of zero, causing a kernel BUG at mm/usercopy.c:102 due to an invalid memory access check [1].

Exploitation

A local attacker can trigger this bug by issuing a listxattr system call on an NFSv4.2 filesystem with a specific buffer size that causes the internal size to become zero. This does not require special privileges, only the ability to list attributes on an NFS-mounted directory. The bug is reproducible when the filesystem has extended attributes such as system.nfs4_acl.

Impact

Successful exploitation results in a kernel panic (BUG), causing a denial of service (DoS) on the affected system. This can disrupt services and require a system reboot. The vulnerability affects Linux kernels prior to the fix, including those used in products like SIMATIC S7-1500 TM MFP (GNU/Linux subsystem) all versions [1].

Mitigation

The Linux kernel community has patched the issue by adding a check that returns the ERANGE error when the output size exceeds the buffer size. Users should update to a stable kernel version containing this fix (e.g., commits in the stable tree). For affected products like the SIMATIC S7-1500 TM MFP, Siemens recommends updating as part of their security advisory [1].

References
  1. SSA-265688

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

109

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

9

News mentions

0

No linked articles in our index yet.