---
id: CVE-2024-26870
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102

  A call to listxattr() with a buffer size = 0 returns the actual
  size of the buffer needed for a subsequent …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102

  A call to listxattr() with a buffer size = 0 returns the actual
  size of the buffer needed for a subsequent …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.9, < 5.10.214'
  - 'linux_kernel >= 5.11, < 5.15.153'
  - 'linux_kernel >= 5.16, < 6.1.83'
  - 'linux_kernel >= 6.2, < 6.6.23'
  - 'linux_kernel >= 6.7, < 6.7.11'
  - 'linux_kernel >= 6.8, < 6.8.2'
  - debian_linux = 10.0
patched:
  - linux_kernel 6.8.2
published: '2024-04-17'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:17:26.880'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-26870'
references:
  - url: 'https://git.kernel.org/stable/c/06e828b3f1b206de08ef520fc46a40b22e1869cb'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/23bfecb4d852751d5e403557dd500bb563313baf'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/251a658bbfceafb4d58c76b77682c8bf7bcfad65'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4403438eaca6e91f02d272211c4d6b045092396b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/79cdcc765969d23f4e3d6ea115660c3333498768'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/80365c9f96015bbf048fdd6c8705d3f8770132bf'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9d52865ff28245fc2134da9f99baff603a24407a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/06e828b3f1b206de08ef520fc46a40b22e1869cb'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/23bfecb4d852751d5e403557dd500bb563313baf'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/251a658bbfceafb4d58c76b77682c8bf7bcfad65'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/4403438eaca6e91f02d272211c4d6b045092396b'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/79cdcc765969d23f4e3d6ea115660c3333498768'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/80365c9f96015bbf048fdd6c8705d3f8770132bf'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/9d52865ff28245fc2134da9f99baff603a24407a'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-265688.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00283
epssPercentile: 0.20746
ingestedAt: '2026-10-15T03:30:12.654Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-05-28T19:56:13.503124Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102

A call to listxattr() with a buffer size = 0 returns the actual
size of the buffer needed for a subsequent call. When size > 0,
nfs4_listxattr() does not return an error because either
generic_listxattr() or nfs4_listxattr_nfs4_label() consumes
exactly all the bytes then size is 0 when calling
nfs4_listxattr_nfs4_user() which then triggers the following
kernel BUG:

  [   99.403778] kernel BUG at mm/usercopy.c:102!
  [   99.404063] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP
  [   99.408463] CPU: 0 PID: 3310 Comm: python3 Not tainted 6.6.0-61.fc40.aarch64 #1
  [   99.415827] Call trace:
  [   99.415985]  usercopy_abort+0x70/0xa0
  [   99.416227]  __check_heap_object+0x134/0x158
  [   99.416505]  check_heap_object+0x150/0x188
  [   99.416696]  __check_object_size.part.0+0x78/0x168
  [   99.416886]  __check_object_size+0x28/0x40
  [   99.417078]  listxattr+0x8c/0x120
  [   99.417252]  path_listxattr+0x78/0xe0
  [   99.417476]  __arm64_sys_listxattr+0x28/0x40
  [   99.417723]  invoke_syscall+0x78/0x100
  [   99.417929]  el0_svc_common.constprop.0+0x48/0xf0
  [   99.418186]  do_el0_svc+0x24/0x38
  [   99.418376]  el0_svc+0x3c/0x110
  [   99.418554]  el0t_64_sync_handler+0x120/0x130
  [   99.418788]  el0t_64_sync+0x194/0x198
  [   99.418994] Code: aa0003e3 d000a3e0 91310000 97f49bdb (d4210000)

Issue is reproduced when generic_listxattr() returns 'system.nfs4_acl',
thus calling lisxattr() with size = 16 will trigger the bug.

Add check on nfs4_listxattr() to return ERANGE error when it is
called with size > 0 and the return value is greater than size.

## Affected

- `linux_kernel >= 5.9, < 5.10.214`
- `linux_kernel >= 5.11, < 5.15.153`
- `linux_kernel >= 5.16, < 6.1.83`
- `linux_kernel >= 6.2, < 6.6.23`
- `linux_kernel >= 6.7, < 6.7.11`
- `linux_kernel >= 6.8, < 6.8.2`
- `debian_linux = 10.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.8.2`