CVE-2024-26824 crypto: algif_hash - Remove bogus SGL free on zero-length error path
A local attacker can cause a kernel crash by triggering a double-free or invalid memory access when hashing zero-length messages in the algif_hash module.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-26824?
CVE-2024-26824 is a high-severity vulnerability in Linux kernel, published on 17 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
crypto: algif_hash - Remove bogus SGL free on zero-length error path
When a zero-length message is hashed by algif_hash, and an error is triggered, it tries to free an SG list that was never allocated in the first place. Fix this by not freeing the SG list on the zero-length error path.
Which versions are affected by CVE-2024-26824?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-26824?
Apply the vendor's patch.
Is CVE-2024-26824 being exploited?
There is no known exploitation of CVE-2024-26824 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-26824, DEBIAN-CVE-2024-26824, GHSA-c8fg-x59g-83c8, UBUNTU-CVE-2024-26824.