CVE-2024-26789

What it actually does

Out-of-bounds memory access in the ARM64 bit-sliced NEON AES-CTR implementation when falling back to the plain NEON helper on inputs shorter than 16 bytes, because the fallback omits the temporary buffer copy used by the direct plain NEON path.

Why it matters to the business

Kernel crashes, potential information disclosure, or denial of service on ARM64 Linux systems performing AES-CTR operations on small data blocks; older unpatched kernels remain exposed nearly three years after disclosure.

How an attack unfolds

An attacker supplies a short input (under 16 bytes) to an AES-CTR operation that routes through the bit-sliced NEON code path; the missing temporary buffer causes the plain NEON assembly helper to read or write beyond allocated memory.

How to fix it

Upgrade the Linux kernel to a version containing commit 034e2d70b5c7f578200ad09955aeb2aa65d1164a or any later stable branch that includes the fix; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting the neonbs source or by running targeted tests that exercise AES-CTR with inputs shorter than 16 bytes and verifying no out-of-bounds faults occur.

Typical attack path

1. Locate ARM64 Linux systems performing AES-CTR encryption or decryption
2. Trigger crypto operations with inputs shorter than 16 bytes
3. Cause the bit-sliced NEON path to invoke the plain NEON helper without the short-input workaround
4. Trigger out-of-bounds memory access leading to crash or data exposure

How to detect it

Inspect kernel logs for oops or panic messages referencing neonbs, bit-sliced AES, or short-input fallbacks; correlate with processes performing AES-CTR on small payloads.

What your security team should do

• Prioritize kernel upgrades on all ARM64 systems that perform AES-CTR operations
• Review boot and crypto-related logs for unexplained oops or panic entries
• Apply the fix across the fleet before any scheduled maintenance windows close