CVE-2024-26638

What it actually does

Uninitialized fields in struct msghdr (specifically msg_get_inq) are passed through nbd recv paths into tcp_recvmsg, allowing kernel use of uninitialized memory values.

Why it matters to the business

Potential kernel crashes, information disclosure, or instability on systems using the nbd driver; low exploitability and no known active campaigns reduce immediate operational risk, though kernel updates remain necessary for long-term stability.

How an attack unfolds

An attacker with local access or control over an nbd connection triggers recv_work in the nbd driver without proper msghdr initialization, causing the kernel to process uninitialized values from tcp_recvmsg and potentially leak memory or crash the system.

How to fix it

Update the Linux kernel to commit d9c54763e5cdbbd3f81868597fe8aca3c96e6387 or later; for AlmaLinux 8 apply cockpit-session-recording 7-2.el8 or equivalent package update that pulls the fixed kernel.

How to confirm the fix worked

Confirm kernel version contains d9c54763e5cdbbd3f81868597fe8aca3c96e6387; run syzkaller-style nbd workloads and verify absence of KMSAN uninit-value reports in tcp_recvmsg and nbd paths.

Typical attack path

1. Obtain local access or configure an nbd target
2. Trigger nbd_read_reply and recv_work paths
3. Force use of uninitialized msg_get_inq in tcp stack
4. Observe kernel oops, KMSAN report, or memory disclosure

How to detect it

Search kernel logs for KMSAN reports referencing tcp_recvmsg and nbd.c recv_work; inspect for uninit-value warnings on struct msghdr created in __sock_xmit.

What your security team should do

• Prioritize kernel updates on any system exposing nbd devices
• Monitor EPSS and KEV status for changes given 940 days since publication
• Restrict nbd usage to trusted networks until patched