Skip to content
Heist/ feed
Back to feed
UnratedFix available

arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY When CONFIG_DEBUG_BUGVERBOSE=n, we fail to add necessary padding bytes to bug_table entries, and as a result the last entry in a bug table will be ignored, potentially leading to an unexpected panic(). All prior entries in the table will be handled correctly. The arm64 ABI requires that struct fields of up to 8 bytes are naturally-aligned, with padding added within a struct such that struct are suitably aligned within arrays. When CONFIG_DEBUG_BUGVERPOSE=y, the layout of a bug_entry is: struct bug_entry { signed int bug_addr_disp; // 4 bytes signed int file_disp; // 4 bytes unsigned short line; // 2 bytes unsigned short flags; // 2 bytes } ... with 12 bytes total, requiring 4-byte alignment. When CONFIG_DEBUG_BUGVERBOSE=n, the layout of a bug_entry is: struct bug_entry { signed int bug_addr_disp; // 4 bytes unsigned short flags; // 2 bytes < implicit padding > // 2 bytes } ... with 8 bytes total, with 6 bytes of data and 2 bytes of trailing padding, requiring 4-byte alginment. When we create a bug_entry in assembly, we align the start of the entry to 4 bytes, which implicitly handles padding for any prior entries. However, we do not align the end of the entry, and so when CONFIG_DEBUG_BUGVERBOSE=n, the final entry lacks the trailing padding bytes. For the main kernel image this is not a problem as find_bug() doesn't depend on the trailing padding bytes wh

Products
Kernel
Affected versions
Not specified
Fixed versions
4.19.316, 5.10.219, 5.15.161, 5.4.278, 6.1.93, 6.6.33, 6.9.4
CVEs
CVE-2024-39488
Confirmed fixed CVEs
Not specified
Updated in this feed
8 Nov 2026, 02:56 UTC · Revision 1

Source evidence

arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY

core-osv · Original source

Published 10 Jul 2024, 07:14 UTC

In the Linux kernel, the following vulnerability has been resolved: arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY When CONFIG_DEBUG_BUGVERBOSE=n, we fail to add necessary padding bytes to bug_table entries, and as a result the last entry in a bug table will be ignored, potentially leading to an unexpected panic(). All prior entries in the table will be handled correctly. The arm64 ABI requires that struct fields of up to 8 bytes are naturally-aligned, with padding added within a struct such that struct are suitably aligned within arrays. When CONFIG_DEBUG_BUGVERPOSE=y, the layout of a bug_entry is: struct bug_entry { signed int bug_addr_disp; // 4 bytes signed int file_disp; // 4 bytes unsigned short line; // 2 bytes unsigned short flags; // 2 bytes } ... with 12 bytes total, requiring 4-byte alignment. When CONFIG_DEBUG_BUGVERBOSE=n, the layout of a bug_entry is: struct bug_entry { signed int bug_addr_disp; // 4 bytes unsigned short flags; // 2 bytes < implicit padding > // 2 bytes } ... with 8 bytes total, with 6 bytes of data and 2 bytes of trailing padding, requiring 4-byte alginment. When we create a bug_entry in assembly, we align the start of the entry to 4 bytes, which implicitly handles padding for any prior entries. However, we do not align the end of the entry, and so when CONFIG_DEBUG_BUGVERBOSE=n, the final entry lacks the trailing padding bytes. For the main kernel image this is not a problem as find_bug() doesn't depend on the trailing padding bytes wh

osv:CVE-2024-39488

Kernel

Fixed versions: 4.19.316, 5.4.278, 5.10.219, 5.15.161, 6.1.93, 6.6.33, 6.9.4

Complete source record
{
  "id": "b5760065fe86c8caf52b7f4a02c526d75fc64ec68935194d10a59c56ed0ad7c2",
  "url": "https://osv.dev/vulnerability/CVE-2024-39488",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY When CONFIG_DEBUG_BUGVERBOSE=n, we fail to add necessary padding bytes to bug_table entries, and as a result the last entry in a bug table will be ignored, potentially leading to an unexpected panic(). All prior entries in the table will be handled correctly. The arm64 ABI requires that struct fields of up to 8 bytes are naturally-aligned, with padding added within a struct such that struct are suitably aligned within arrays. When CONFIG_DEBUG_BUGVERPOSE=y, the layout of a bug_entry is: struct bug_entry { signed int bug_addr_disp; // 4 bytes signed int file_disp; // 4 bytes unsigned short line; // 2 bytes unsigned short flags; // 2 bytes } ... with 12 bytes total, requiring 4-byte alignment. When CONFIG_DEBUG_BUGVERBOSE=n, the layout of a bug_entry is: struct bug_entry { signed int bug_addr_disp; // 4 bytes unsigned short flags; // 2 bytes < implicit padding > // 2 bytes } ... with 8 bytes total, with 6 bytes of data and 2 bytes of trailing padding, requiring 4-byte alginment. When we create a bug_entry in assembly, we align the start of the entry to 4 bytes, which implicitly handles padding for any prior entries. However, we do not align the end of the entry, and so when CONFIG_DEBUG_BUGVERBOSE=n, the final entry lacks the trailing padding bytes. For the main kernel image this is not a problem as find_bug() doesn't depend on the trailing padding bytes wh",
    "evidence": "osv:CVE-2024-39488",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "4.19.316",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.4.278",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.10.219",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.161",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.93",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.33",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.9.4",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2024-39488",
      "aliases": [
        "CVE-2024-39488"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "9fb7410f955f7a62c1f882ca8f9ffd4525907e28"
                },
                {
                  "fixed": "f221bd58db0f6ca087ac0392284f6bce21f4f8ea"
                },
                {
                  "fixed": "22469a0335a1a1a690349b58bcb55822457df81e"
                },
                {
                  "fixed": "461a760d578b2b2c2faac3040b6b7c77baf128f8"
                },
                {
                  "fixed": "c1929c041a262a4a27265db8dce3619c92aa678c"
                },
                {
                  "fixed": "3fd487ffaa697ddb05af78a75aaaddabe71c52b0"
                },
                {
                  "fixed": "9f2ad88f9b349554f64e4037ec185c84d7dd9c7d"
                },
                {
                  "fixed": "c27a2f7668e215c1ebbccd96fab27a220a93f1f7"
                },
                {
                  "fixed": "ffbf4fb9b5c12ff878a10ea17997147ea4ebea6f"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-39488.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.3.0"
                },
                {
                  "fixed": "4.19.316"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.20.0"
                },
                {
                  "fixed": "5.4.278"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.5.0"
                },
                {
                  "fixed": "5.10.219"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.161"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.93"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.33"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.9.4"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-39488.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:53.193155926Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/22469a0335a1a1a690349b58bcb55822457df81e",
        "https://git.kernel.org/stable/c/3fd487ffaa697ddb05af78a75aaaddabe71c52b0",
        "https://git.kernel.org/stable/c/461a760d578b2b2c2faac3040b6b7c77baf128f8",
        "https://git.kernel.org/stable/c/9f2ad88f9b349554f64e4037ec185c84d7dd9c7d",
        "https://git.kernel.org/stable/c/c1929c041a262a4a27265db8dce3619c92aa678c",
        "https://git.kernel.org/stable/c/c27a2f7668e215c1ebbccd96fab27a220a93f1f7",
        "https://git.kernel.org/stable/c/f221bd58db0f6ca087ac0392284f6bce21f4f8ea",
        "https://git.kernel.org/stable/c/ffbf4fb9b5c12ff878a10ea17997147ea4ebea6f",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39488.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2024-39488",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39488.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2024-39488",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 521997,
  "published_at": "2024-07-10T07:14:08.319+00:00"
}