---
id: CVE-2024-26906
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()

  When trying to use copy_from_kernel_nofault() to read vsyscall page
  through a bpf program, the follo…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()

  When trying to use copy_from_kernel_nofault() to read vsyscall page
  through a bpf program, the follo…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
vendor: linux
product: linux_kernel
affected:
  - linux_kernel < 5.10.214
  - 'linux_kernel >= 5.11, < 5.15.153'
  - 'linux_kernel >= 5.16, < 6.1.83'
  - 'linux_kernel >= 6.2, < 6.6.23'
  - 'linux_kernel >= 6.7, < 6.7.11'
  - linux_kernel = 6.8
  - debian_linux = 10.0
patched:
  - linux_kernel 6.7.11
published: '2024-04-17'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:17:31.353'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-26906'
references:
  - url: 'https://git.kernel.org/stable/c/29bd6f86904682adafe9affbc7f79b14defcaff8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/32019c659ecfe1d92e3bf9fcdfbb11a7c70acd58'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/57f78c46f08198e1be08ffe99c4c1ccc12855bf5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6e4694e65b6db4c3de125115dd4f55848cc48381'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e8a67fe34b76a49320b33032228a794f40b0316b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f175de546a3eb77614d94d4c02550181c0a8493e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/29bd6f86904682adafe9affbc7f79b14defcaff8'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/32019c659ecfe1d92e3bf9fcdfbb11a7c70acd58'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/57f78c46f08198e1be08ffe99c4c1ccc12855bf5'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/6e4694e65b6db4c3de125115dd4f55848cc48381'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/e8a67fe34b76a49320b33032228a794f40b0316b'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/f175de546a3eb77614d94d4c02550181c0a8493e'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-265688.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00253
epssPercentile: 0.16671
ingestedAt: '2026-10-15T03:30:12.660Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-09-10T15:47:59.842385Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()

When trying to use copy_from_kernel_nofault() to read vsyscall page
through a bpf program, the following oops was reported:

  BUG: unable to handle page fault for address: ffffffffff600000
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 3231067 P4D 3231067 PUD 3233067 PMD 3235067 PTE 0
  Oops: 0000 [#1] PREEMPT SMP PTI
  CPU: 1 PID: 20390 Comm: test_progs ...... 6.7.0+ #58
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ......
  RIP: 0010:copy_from_kernel_nofault+0x6f/0x110
  ......
  Call Trace:
   <TASK>
   ? copy_from_kernel_nofault+0x6f/0x110
   bpf_probe_read_kernel+0x1d/0x50
   bpf_prog_2061065e56845f08_do_probe_read+0x51/0x8d
   trace_call_bpf+0xc5/0x1c0
   perf_call_bpf_enter.isra.0+0x69/0xb0
   perf_syscall_enter+0x13e/0x200
   syscall_trace_enter+0x188/0x1c0
   do_syscall_64+0xb5/0xe0
   entry_SYSCALL_64_after_hwframe+0x6e/0x76
   </TASK>
  ......
  ---[ end trace 0000000000000000 ]---

The oops is triggered when:

1) A bpf program uses bpf_probe_read_kernel() to read from the vsyscall
page and invokes copy_from_kernel_nofault() which in turn calls
__get_user_asm().

2) Because the vsyscall page address is not readable from kernel space,
a page fault exception is triggered accordingly.

3) handle_page_fault() considers the vsyscall page address as a user
space address instead of a kernel space address. This results in the
fix-up setup by bpf not being applied and a page_fault_oops() is invoked
due to SMAP.

Considering handle_page_fault() has already considered the vsyscall page
address as a userspace address, fix the problem by disallowing vsyscall
page read for copy_from_kernel_nofault().

## Affected

- `linux_kernel < 5.10.214`
- `linux_kernel >= 5.11, < 5.15.153`
- `linux_kernel >= 5.16, < 6.1.83`
- `linux_kernel >= 6.2, < 6.6.23`
- `linux_kernel >= 6.7, < 6.7.11`
- `linux_kernel = 6.8`
- `debian_linux = 10.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.7.11`