VYPR
← All advisories
Medium severity5.5NVD Advisory· Published May 1, 2024· Updated May 12, 2026

CVE-2024-26993

CVE-2024-26993

Description

In the Linux kernel, the following vulnerability has been resolved:

fs: sysfs: Fix reference leak in sysfs_break_active_protection()

The sysfs_break_active_protection() routine has an obvious reference leak in its error path. If the call to kernfs_find_and_get() fails then kn will be NULL, so the companion sysfs_unbreak_active_protection() routine won't get called (and would only cause an access violation by trying to dereference kn->parent if it was called). As a result, the reference to kobj acquired at the start of the function will never be released.

Fix the leak by adding an explicit kobject_put() call when kn is NULL.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2024-26993 is a reference leak in sysfs_break_active_protection() in the Linux kernel, where a failed kernfs_find_and_get() call prevents a kobject reference from being released.

CVE-2024-26993 describes a reference leak vulnerability in the Linux kernel's sysfs_break_active_protection() function. The issue occurs when the call to kernfs_find_and_get() fails, leaving kn as NULL. In this error path, the companion sysfs_unbreak_active_protection() function is not called, and the reference to the kobject acquired at the start of the function (kobj) is never released, causing a memory leak [1][2].

Exploitation

This vulnerability is local and requires no special privileges to trigger, but it does rely on a specific condition where kernfs_find_and_get() fails. An attacker with local access could potentially exploit this by causing the error path to be hit repeatedly, leading to a gradual depletion of kobject references. The attack surface is limited to systems where sysfs operations are performed and where the error condition can be reliably triggered.

Impact

A successful exploitation leads to a memory leak, which can result in system instability or denial of service as kernel memory resources are exhausted. The CVSS v3.1 base score is 5.5 (Medium) with a vector of AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating no confidentiality or integrity impact but high availability impact [1][2].

Mitigation

The fix involves adding an explicit kobject_put() call when kn is NULL, ensuring the reference is properly released. This patch has been applied to the Linux kernel stable tree, and affected products, such as the SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (all versions), are listed as affected by this CVE [1]. Users are advised to apply the latest kernel updates to mitigate the vulnerability.

References
  1. SSA-265688
  2. SSA-613116

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

179

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

15

News mentions

0

No linked articles in our index yet.