CVE-2024-26763

What it actually does

In dm-crypt with authenticated encryption, concurrent modification of plaintext buffers (via O_DIRECT) after bio setup but before encryption produces invalid authentication tags, allowing device corruption.

Why it matters to the business

Systems using dm-crypt with authenticated encryption modes on Linux kernels face risk of storage corruption and data integrity loss, increasing downtime and recovery costs on affected servers and endpoints.

How an attack unfolds

A local attacker opens a file on a dm-crypt device with O_DIRECT, writes data, then modifies the in-memory buffer before encryption completes; the resulting invalid tag corrupts the underlying device when the bio is processed.

How to fix it

Upgrade the Linux kernel to a version containing commit 43a202bd552976497474ae144942e32cc5f34d7e or later; rebuild and reboot with the patched dm-crypt module. Disable O_DIRECT writes to dm-crypt devices using authenticated encryption until patched.

How to confirm the fix worked

Confirm kernel source contains the fix (copy data into clone bio before encryption), run regression tests exercising O_DIRECT writes under authenticated encryption, and verify no device corruption occurs.

Typical attack path

1. Locate dm-crypt target configured for authenticated encryption
2. Open target device or file with O_DIRECT flag
3. Issue write and concurrently alter the user buffer
4. Trigger encryption path that consumes the now-modified data
5. Observe invalid authentication tag and resulting device corruption

How to detect it

Search kernel logs and dm-crypt audit trails for authentication tag mismatch or integrity failure messages around the time of O_DIRECT writes; examine bio and clone bio handling in crash dumps for evidence of concurrent modification.

What your security team should do

• Apply the referenced kernel patch or distribution update immediately on all systems using dm-crypt with authenticated encryption
• Audit workloads for O_DIRECT usage against dm-crypt devices and restrict where possible
• Monitor for dm-crypt authentication failures in system logs after patching