CVE-2024-26678

What it actually does

The kernel image places an 8-byte .compat section at the end of the memory view without 4k padding, violating PE/COFF requirements for monotonically increasing file and memory views with no gaps in section headers.

Why it matters to the business

Systems using certain third-party EFI loaders may fail to boot the affected kernel, leading to deployment failures or the need to disable mixed-mode EFI support on a small number of legacy configurations.

How an attack unfolds

An attacker does not directly exploit the flaw; instead, a non-compliant kernel image built with CONFIG_EFI_MIXED is rejected at load time by strict PE/COFF implementations, resulting in boot denial on affected firmware.

How to fix it

Upgrade to Linux kernel 6.7.5 or later, or apply commit d327e961573fc335af0ae8a160302205327e1f4e. Rebuild and redeploy the kernel; optionally disable CONFIG_EFI_MIXED if the feature is unused.

How to confirm the fix worked

Confirm the .compat section appears with proper alignment and monotonic section ordering in the rebuilt PE image using objdump or readpe; verify successful boot on both mixed and native EFI firmware.

Typical attack path

1. Build a kernel with CONFIG_EFI_MIXED enabled
2. Place the resulting image on media used by a strict PE/COFF loader
3. Trigger firmware hand-off that invokes the loader
4. Loader rejects the image due to non-monotonic section layout

How to detect it

Review kernel build logs and EFI boot logs for PE section parsing errors or failed mixed-mode handoff attempts; no runtime IOCs exist after the image is rejected at load time.

What your security team should do

• Prioritize upgrade to fixed kernel versions on all x86 EFI systems
• Audit build configurations for unnecessary CONFIG_EFI_MIXED usage
• Test boot images against reference and third-party EFI loaders before rollout