Vulnary
← back to the feed
Critical· 9.8official fix available

CVE-2024-26877

A critical vulnerability in the Linux kernel's Xilinx crypto driver occurs when crypto_finalize_request is called without disabling bottom halves (BH), which can trigger a warning and potentially lead to denial of service or privilege escalation. The issue has been resolved by a patch that ensures BH is disabled when calling crypto_finalize_request. Users should apply the kernel patch or upgrade to a fixed kernel version to eliminate the risk.

publishedApr 17, 2024
last modifiedAug 4, 2026
sourcesNVD
severity · cvss
9.8
critical · how bad it is
exploitation · epss
<1%
51th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Sep 4, 2026

An official fix is available, so this entry is kept for 30 days and then removed automatically.

01

Who is affected

Linux kernel users, particularly those using the Xilinx crypto driver on platforms such as Debian Linux 10.0.

02

Real-world impact

Exploitation could allow an attacker to cause a kernel warning, disrupt system stability, or potentially gain elevated privileges.

03

Why this severity

The CVSS v3.1 base score is 9.8 (Critical) due to network‑adjacent attack vector, low attack complexity, no required privileges or user interaction, and high impacts to confidentiality, integrity, and availability.

04

What to do about it

official fix available
recommended steps
  1. 01Upgrade the Linux kernel to a version that includes the patch ensuring crypto_finalize_request is called with BH disabled in the Xilinx crypto driver (CVE-2024-26877).

NVD-referenced vendor advisory (Linux kernel fix description)

05

Timeline

  1. Apr 17, 2024 · Apr 17, 2024
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Aug 4, 2026 · 2d ago
    Advisory updated
    The NVD record was last revised.
  3. Aug 5, 2026 · 1d ago
    Official fix available
    A vendor patch or mitigation now exists — see the remediation steps above.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07

References & advisories

NVD advisory ↗Search advisories ↗
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →