Detections
Analytics

Bottlerocket: bottlerocket-kernel-5.15, kernel-5.15: security update to 5.15.173

medium Tenable Self-Hosted Container Security Plugin ID 428083

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: dm-crypt, dm-verity: disable tasklets
 Tasklets have an inherent problem with memory corruption. The function tasklet_action_common calls
 tasklet_trylock, then it calls the tasklet callback and then it calls tasklet_unlock. If the tasklet
 callback frees the structure that contains the tasklet or if it calls some code that may free it,
 tasklet_unlock will write into free memory. The commits 8e14f610159d and d9a02e016aaf try to fix it for
 dm-crypt, but it is not a sufficient fix and the data corruption can still happen [1]. There is no fix for
 dm-verity and dm-verity will write into free memory with every tasklet-processed bio. There will be atomic
 workqueues implemented in the kernel 6.9 [2]. They will have better interface and they will not suffer
 from the memory corruption problem. But we need something that stops the memory corruption now and that
 can be backported to the stable kernels. So, I'm proposing this commit that disables tasklets in both dm-
 crypt and dm-verity. This commit doesn't remove the tasklet support, because the tasklet code will be
 reused when atomic workqueues will be implemented. [1]
 https://lore.kernel.org/all/[email protected]/T/ [2]
 https://lore.kernel.org/lkml/[email protected]/ (CVE-2024-26718)

Plugin Details

Severity: Medium

ID: 428083

Version: Revision 1.2

Type: Local

Published: 6/30/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2024-26718

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 4/3/2024

Reference Information

CVE: CVE-2024-26718