{
  "cveId": "CVE-2024-26902",
  "url": "https://patchblox.com/security/cve/CVE-2024-26902",
  "summary": "CVE-2024-26902 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-26902, released April 17, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  perf: RISCV: Fix panic on pmu overflow handler...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  perf: RISCV: Fix panic on pmu overflow handler  (1 \u003C\u003C idx) of int is not desired when setting bits in unsigned long overflowed_ctrs, use BIT() instead. This panic happens when running \u0027perf record -e branches\u0027 on sophgo sg2042.  [  273.311852] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098 [  273.320851] Oops [#1] [  273.323179] Modules linked in: [  273.326303] CPU: 0 PID: 1475 Comm: perf Not tainted 6.6.0-rc3\u002B #9 [  273.332521] Hardware name: Sophgo Mango (DT) [  273.336878] epc : riscv_pmu_ctr_get_width_mask\u002B0x8/0x62 [  273.342291]  ra : pmu_sbi_ovf_handler\u002B0x2e0/0x34e [  273.347091] epc : ffffffff80aecd98 ra : ffffffff80aee056 sp : fffffff6e36928b0 [  273.354454]  gp : ffffffff821f82d0 tp : ffffffd90c353200 t0 : 0000002ade4f9978 [  273.361815]  t1 : 0000000000504d55 t2 : ffffffff8016cd8c s0 : fffffff6e3692a70 [  273.369180]  s1 : 0000000000000020 a0 : 0000000000000000 a1 : 00001a8e81800000 [  273.376540]  a2 : 0000003c00070198 a3 : 0000003c00db75a4 a4 : 0000000000000015 [  273.383901]  a5 : ffffffd7ff8804b0 a6 : 0000000000000015 a7 : 000000000000002a [  273.391327]  s2 : 000000000000ffff s3 : 0000000000000000 s4 : ffffffd7ff8803b0 [  273.398773]  s5 : 0000000000504d55 s6 : ffffffd905069800 s7 : ffffffff821fe210 [  273.406139]  s8 : 000000007fffffff s9 : ffffffd7ff8803b0 s10: ffffffd903f29098 [  273.413660]  s11: 0000000080000000 t3 : 0000000000000003 t4 : ffffffff8017a0ca [  273.421022]  t5 : ffffffff8023cfc2 t6 : ffffffd9040780e8 [  273.426437] status: 0000000200000100 badaddr: 0000000000000098 cause: 000000000000000d [  273.434512] [\u003Cffffffff80aecd98\u003E] riscv_pmu_ctr_get_width_mask\u002B0x8/0x62 [  273.441169] [\u003Cffffffff80076bd8\u003E] handle_percpu_devid_irq\u002B0x98/0x1ee [  273.447562] [\u003Cffffffff80071158\u003E] generic_handle_domain_irq\u002B0x28/0x36 [  273.454151] [\u003Cffffffff8047a99a\u003E] riscv_intc_irq\u002B0x36/0x4e [  273.459659] [\u003Cffffffff80c944de\u003E] handle_riscv_irq\u002B0x4a/0x74 [  273.465442] [\u003Cffffffff80c94c48\u003E] do_irq\u002B0x62/0x92 [  273.470360] Code: 0420 60a2 6402 5529 0141 8082 0013 0000 0013 0000 (6d5c) b783 [  273.477921] ---[ end trace 0000000000000000 ]--- [  273.482630] Kernel panic - not syncing: Fatal exception in interrupt",
  "published": "2024-04-17T11:15:11Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00238,
  "epssPercentile": 0.14879,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.7.12-1",
      "fix": "DEBIAN-CVE-2024-26902",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-26902",
      "released": "2024-04-17T11:15:11Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.7.12-1",
      "fix": "DEBIAN-CVE-2024-26902",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-26902",
      "released": "2024-04-17T11:15:11Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}