CVE-2024-26640

What it actually does

The flaw permits mapping of compound pages or filesystem-owned pages (with non-NULL mapping) into TCP rx zerocopy via can_map_frag(), allowing ext4 or similar file pages to be referenced instead of only NIC-allocated pages and triggering kernel panic on subsequent operations.

Why it matters to the business

Affected Linux systems may experience unexpected kernel crashes during network transfers involving sendfile and TCP zerocopy, leading to service disruption, loss of availability, and operational downtime until patched kernels are deployed.

How an attack unfolds

An attacker opens TCP sockets, memory-maps a region, prepares a file with fallocate, uses sendfile to inject file-backed pages into the TCP socket, then invokes getsockopt with TCP_ZEROCOPY_RECEIVE to trigger the missing sanity checks and cause a panic; the original report demonstrated this loopback scenario on ext4.

How to fix it

Upgrade the Linux kernel to a version containing commit f48bf9a83b1666d934247cb58a9887d7b3127b6f or later; rebuild and reboot with the patched kernel; where immediate patching is not possible, disable TCP zerocopy receive usage in applications.

How to confirm the fix worked

Confirm the running kernel contains commit f48bf9a83b1666d934247cb58a9887d7b3127b6f; attempt to reproduce the reported sendfile + TCP_ZEROCOPY_RECEIVE sequence and verify no panic occurs; inspect can_map_frag() source for the added NULL mapping and non-compound page checks.

Typical attack path

1. Create and configure TCP sockets for zerocopy
2. Memory-map a buffer for receive zerocopy
3. Open a regular file and allocate space with fallocate
4. Call sendfile to associate file pages with the TCP socket
5. Invoke getsockopt TCP_ZEROCOPY_RECEIVE to map the pages

How to detect it

Review kernel logs for oops or panic messages referencing tcp, zerocopy, or can_map_frag; search system call audit logs for combinations of sendfile followed by getsockopt on TCP sockets using the TCP_ZEROCOPY_RECEIVE option.

What your security team should do

• Prioritize deployment of kernels containing commit f48bf9a83b1666d934247cb58a9887d7b3127b6f across all Linux fleets
• Audit applications for use of TCP_ZEROCOPY_RECEIVE and restrict it to trusted paths only
• Enable kernel panic logging and monitoring to detect related crashes