CVE-2024-26795

What it actually does

The flaw permits out-of-bounds vmemmap accesses during pfn_to_page and page_to_pfn operations on RISC-V because the vmemmap base is not offset to align with the first page of physical memory, allowing DRAM_BASE values inside valid limits to produce invalid SV39/48/57 addresses.

Why it matters to the business

RISC-V Linux systems may experience kernel panics or memory corruption under normal page-frame operations, leading to unplanned downtime and reduced platform availability for affected workloads.

How an attack unfolds

An attacker with local access triggers page-frame conversion macros that dereference addresses outside the intended vmemmap bounds; the missing offset allows the resulting SV39/48/57 virtual address to fall outside the mapped region, causing a kernel fault or corruption.

How to fix it

Update the Linux kernel to the commit 8af1c121b0102041809bc137ec600d1865eaeedd or later stable releases that contain the vmemmap offset fix for RISC-V sparse memory.

How to confirm the fix worked

Verify the running kernel contains commit 8af1c121b0102041809bc137ec600d1865eaeedd; confirm vmemmap base calculation now aligns the first vmemmap page with the first physical page for all valid DRAM_BASE values.

Typical attack path

1. Obtain local unprivileged access on a RISC-V Linux system using a vulnerable kernel
2. Perform operations that invoke pfn_to_page or page_to_pfn on valid DRAM pages
3. Trigger the unadjusted vmemmap base calculation that produces an out-of-bounds address
4. Cause kernel memory fault or data corruption during the resulting access

How to detect it

Review kernel logs for oops or panic entries containing vmemmap, pfn_to_page, or page_to_pfn on RISC-V; inspect for unexpected page-frame conversion faults after boot or during memory pressure.

What your security team should do

• Prioritize kernel upgrade on all RISC-V production systems within the next maintenance window
• Include the fixed commit hash in automated kernel build and deployment pipelines
• Monitor RISC-V kernel stability metrics for panics referencing vmemmap or pfn conversions until patches are applied