CVE-2024-26744

What it actually does

Loading the ib_srpt kernel module with the srpt_service_guid parameter triggers a NULL pointer dereference in parse_one during argument parsing, causing a kernel crash.

Why it matters to the business

Systems relying on RDMA/InfiniBand storage targets can experience unexpected kernel panics and service disruption when the module is loaded with the documented parameter, leading to downtime until the kernel is updated.

How an attack unfolds

An attacker with the ability to load the ib_srpt module (typically requiring local root or module-loading privileges) passes the srpt_service_guid parameter at insmod or modprobe time; the unhandled NULL dereference in the parameter parser immediately panics the kernel.

How to fix it

Update the Linux kernel to the commit 84f1dac960cfa210a3b7a7522e6c2320ae91932b or later stable releases that contain the fix for RDMA/srpt parameter handling.

How to confirm the fix worked

Verify the running kernel contains commit 84f1dac960cfa210a3b7a7522e6c2320ae91932b or test that loading ib_srpt with srpt_service_guid no longer produces a NULL pointer dereference.

Typical attack path

1. Obtain local code execution or root privileges on a Linux system using the ib_srpt module
2. Invoke insmod or modprobe ib_srpt srpt_service_guid=<value>
3. Trigger NULL pointer dereference in parse_args leading to kernel panic

How to detect it

Search kernel logs and crash dumps for the exact BUG line "kernel NULL pointer dereference" together with the call trace containing parse_one and load_module when ib_srpt is involved.

What your security team should do

• Prioritize kernel upgrades on all systems that use the ib_srpt module
• Restrict unprivileged module loading via kernel module signing and CAP_SYS_MODULE controls until patches are applied
• Monitor for kernel oops/panic logs containing parse_one and ib_srpt references