CVE-2024-26828
A flaw in the Linux kernel's CIFS (Common Internet File System) component allows for a memory error during the parsing of server interfaces. This occurs because the system incorrectly handles negative values when checking buffer sizes, leading to an integer underflow.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users running Linux kernel version 6.8 or affected versions of the Linux kernel.
Real-world impact
An attacker could potentially exploit this error to cause system instability or gain unauthorized access by manipulating how the kernel processes network file system information.
Why this severity
This vulnerability is rated as critical because it can be exploited remotely without user interaction or special privileges, potentially leading to a complete loss of confidentiality and availability.
What to do about it
- 01Update the Linux kernel to a version that includes the fix for the cifs: parse_server_interfaces() underflow.
NVD-referenced vendor advisory
Timeline
- Apr 17, 2024 · Apr 17, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 22h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.