# CVE-2024-26877: linux: In the Linux kernel, the following vulnerability has been resolved:  crypto: xilinx - call finalize with bh disabled...

CVE-2024-26877 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-26877, released April 17, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2024-26877
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0073
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 17, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  crypto: xilinx - call finalize with bh disabled  When calling crypto_finalize_request, BH should be disabled to avoid triggering the following calltrace:      ------------[ cut here ]------------     WARNING: CPU: 2 PID: 74 at crypto/crypto_engine.c:58 crypto_finalize_request+0xa0/0x118     Modules linked in: cryptodev(O)     CPU: 2 PID: 74 Comm: firmware:zynqmp Tainted: G           O       6.8.0-rc1-yocto-standard #323     Hardware name: ZynqMP ZCU102 Rev1.0 (DT)     pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)     pc : crypto_finalize_request+0xa0/0x118     lr : crypto_finalize_request+0x104/0x118     sp : ffffffc085353ce0     x29: ffffffc085353ce0 x28: 0000000000000000 x27: ffffff8808ea8688     x26: ffffffc081715038 x25: 0000000000000000 x24: ffffff880100db00     x23: ffffff880100da80 x22: 0000000000000000 x21: 0000000000000000     x20: ffffff8805b14000 x19: ffffff880100da80 x18: 0000000000010450     x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000     x14: 0000000000000003 x13: 0000000000000000 x12: ffffff880100dad0     x11: 0000000000000000 x10: ffffffc0832dcd08 x9 : ffffffc0812416d8     x8 : 00000000000001f4 x7 : ffffffc0830d2830 x6 : 0000000000000001     x5 : ffffffc082091000 x4 : ffffffc082091658 x3 : 0000000000000000     x2 : ffffffc7f9653000 x1 : 0000000000000000 x0 : ffffff8802d20000     Call trace:      crypto_finalize_request+0xa0/0x118      crypto_finalize_aead_request+0x18/0x30      zynqmp_handle_aes_req+0xcc/0x388      crypto_pump_work+0x168/0x2d8      kthread_worker_fn+0xfc/0x3a0      kthread+0x118/0x138      ret_from_fork+0x10/0x20     irq event stamp: 40     hardirqs last  enabled at (39): [<ffffffc0812416f8>] _raw_spin_unlock_irqrestore+0x70/0xb0     hardirqs last disabled at (40): [<ffffffc08122d208>] el1_dbg+0x28/0x90     softirqs last  enabled at (36): [<ffffffc080017dec>] kernel_neon_begin+0x8c/0xf0     softirqs last disabled at (34): [<ffffffc080017dc0>] kernel_neon_begin+0x60/0xf0     ---[ end trace 0000000000000000 ]---

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.85-1 | [DEBIAN-CVE-2024-26877](https://patchblox.com/security/data/fix/linux/debian-cve-2024-26877.md) | Apr 17, 2024 |
| Linux | linux Debian 13.5 (trixie) | 6.7.12-1 | [DEBIAN-CVE-2024-26877](https://patchblox.com/security/data/fix/linux/debian-cve-2024-26877.md) | Apr 17, 2024 |
| Linux | linux Debian 14 | 6.7.12-1 | [DEBIAN-CVE-2024-26877](https://patchblox.com/security/data/fix/linux/debian-cve-2024-26877.md) | Apr 17, 2024 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.