CVE-2024-26674

What it actually does

Incorrect exception fixup type (EX_TYPE_DEFAULT instead of EX_TYPE_UACCESS) for get_user/put_user operations prevents recovery from in-kernel machine check exceptions during userspace memory access, causing fatal panics.

Why it matters to the business

Systems experience unexpected crashes and downtime during hardware memory errors, increasing operational costs and risk of service interruption; high prevalence in downstream packages amplifies exposure across distributions.

How an attack unfolds

An attacker or environmental condition induces a machine check exception while the kernel executes get_user or put_user; the wrong fixup type prevents MCA recovery handler from intervening, leading directly to kernel panic. Mention of Android kernel RCE actors indicates potential targeted use in memory error injection scenarios.

How to fix it

Upgrade affected packages to the listed fixed versions: chromium (Debian:11,12,13) to 87.0.4280.88-0.1 and chromium-browser (Ubuntu:16.04:LTS) to 85.0.4183.83-0ubuntu0.16.04.2. Apply kernel patches reverting to _ASM_EXTABLE_UA() for user access fixups. Prioritize patching due to 925 days since publication and Android kernel exploitation mentions.

How to confirm the fix worked

Confirm package versions match the fixed releases above; verify kernel source contains _ASM_EXTABLE_UA() for get_user/put_user exception tables; run memory error injection tests to ensure MCE recovery occurs without panic.

Typical attack path

1. Identify or trigger hardware memory error conditions affecting kernel paths
2. Force execution of get_user/put_user with userspace addresses during the error window
3. Kernel raises #MC with non-recoverable fixup type EX_TYPE_DEFAULT
4. ex_handler_uaccess fails to classify as user access, resulting in panic

How to detect it

Search kernel logs for 'Fatal local machine check' combined with RIP pointing to __get_user_nocheck or __put_user_nocheck; examine MCE records showing Bank 1 errors during user access paths; review threat actor mentions of Android kernel RCE for related memory error patterns.

• Fatal local machine check
• __get_user_nocheck_4
• Machine check: Data load in unrecoverable area of kernel
• ex_handler_uaccess

What your security team should do

• Immediately apply the listed fixed package versions across all Debian and Ubuntu chromium deployments
• Monitor EPSS trend stability and re-evaluate if threat actor activity increases
• Test MCE recovery paths in staging environments before production rollout
• Update detection rules for post-fix verification within 30 days