CVE-2024-26664

What it actually does

Out-of-bounds write to pdata->cpu_map[] array in the coretemp hwmon driver because the array index is populated before the bounds check, enabling memory corruption on systems with more than 128 cores per package.

Why it matters to the business

Kernel instability, crashes, or potential local code execution on high-core-count servers and workstations, leading to downtime, data loss risk, and unplanned maintenance windows.

How an attack unfolds

An attacker with local access loads or triggers the coretemp hwmon driver on a system exceeding 128 cores per package; the missing bounds check allows an out-of-bounds write that can be abused for memory corruption.

How to fix it

Upgrade to a fixed kernel version such as 4.19.307 or later stable releases containing commit 93f0f4e846fcb682c3ec436e3b2e30e5a3a8ee6a; rebuild and reboot all affected systems.

How to confirm the fix worked

Confirm kernel version is at or above the listed fixed releases, verify coretemp driver initialization succeeds without warnings on high-core systems, and run regression tests exercising hwmon core enumeration.

Typical attack path

1. Obtain local shell or user context on target Linux system
2. Ensure coretemp hwmon driver is loaded or can be triggered
3. Trigger temperature or core enumeration paths on >128-core package
4. Exploit resulting out-of-bounds write for privilege escalation or denial of service

How to detect it

Review kernel logs and dmesg for coretemp oops, page faults, or out-of-bounds warnings; correlate with process activity that accesses hwmon interfaces on high-core systems.

What your security team should do

• Prioritize patching high-core-count production systems within standard change windows
• Monitor kernel logs for coretemp-related oops or warnings until patches are deployed
• Restrict unprivileged local access on unpatched systems as a temporary control