CVE-2024-26718

What it actually does

Tasklet callbacks in dm-crypt and dm-verity can free the structure containing the tasklet; subsequent tasklet_unlock then writes into freed memory, causing memory corruption.

Why it matters to the business

Linux systems relying on dm-crypt for disk encryption or dm-verity for integrity verification face risk of kernel memory corruption that can lead to crashes, data corruption, or potential privilege escalation; the issue affects many distributions and requires kernel updates.

How an attack unfolds

An attacker with the ability to trigger I/O operations on dm-crypt or dm-verity devices causes the tasklet callback to free its containing structure; the kernel's tasklet_unlock then performs a write into the now-freed memory, corrupting kernel state that may be leveraged for further exploitation.

How to fix it

Upgrade the Linux kernel to a version containing commit b825e0f9d68c178072bffd32dd34c39e3d2d597a or later; disable tasklets for dm-crypt and dm-verity if a patched kernel cannot be deployed immediately.

How to confirm the fix worked

Confirm the running kernel includes commit b825e0f9d68c or verify that CONFIG_DM_CRYPT and CONFIG_DM_VERITY no longer enable tasklets; test by exercising dm-crypt/dm-verity workloads and checking for absence of memory corruption symptoms.

Typical attack path

1. Obtain local execution or sufficient privileges to issue I/O to encrypted or verified block devices
2. Trigger repeated tasklet-processed bios through normal or crafted disk activity
3. Induce the callback to free the tasklet structure before tasklet_unlock executes
4. Exploit the resulting memory corruption for denial of service or privilege escalation

How to detect it

Examine kernel logs for tasklet-related warnings or oops messages involving dm-crypt or dm-verity; review crash dumps for writes to freed memory in tasklet_unlock paths; no widespread in-the-wild exploitation indicators are known.

What your security team should do

• Prioritize kernel updates on all systems using dm-crypt or dm-verity within the next patching cycle
• Monitor vendor advisories for distribution-specific backports of the disabling commit
• Review and restrict local access to systems where full kernel updates are delayed