CVE-2024-26632

What it actually does

A NULL pointer dereference occurs in bio_first_folio when bio_for_each_folio_all iterates over an empty bio, calling page_folio on NULL and triggering a kernel oops.

Why it matters to the business

System instability and crashes on Linux hosts performing block I/O, leading to downtime, service interruptions, and the need for immediate kernel or dependent package updates across many deployments.

How an attack unfolds

An attacker with local access triggers block I/O paths that produce an empty bio, causing the faulty iteration in bio_for_each_folio_all to dereference NULL and panic the kernel; no widespread remote exploitation reported despite mentions of Android kernel actors.

How to fix it

Update all affected packages to the listed fixed versions (pcp and related AlmaLinux 8 packages to 5.3.1-5.el8) and apply the corresponding upstream kernel patch that moves the end-of-bio check to bio_first_folio with unlikely() annotation.

How to confirm the fix worked

Confirm installed package versions match or exceed the fixed releases, then exercise bio iteration code paths with empty bios to ensure no oops occurs.

Typical attack path

1. Obtain local execution context on an affected Linux system
2. Craft or induce a block I/O request resulting in a zero-length bio
3. Invoke bio_for_each_folio_all on the empty bio
4. Trigger NULL dereference in bio_first_folio leading to kernel oops

How to detect it

Search kernel logs and crash dumps for oops traces containing bio_first_folio, page_folio on NULL, or bio_for_each_folio_all references.

• bio_first_folio
• page_folio
• bio_for_each_folio_all
• NULL pointer dereference in block/bio.c

What your security team should do

• Prioritize patching all listed pcp packages on AlmaLinux 8 to 5.3.1-5.el8
• Monitor kernel logs for oops entries involving bio_for_each_folio_all or page_folio
• Restrict untrusted local code execution on systems handling block devices until updated