CVE-2024-26824

What it actually does

algif_hash error path for zero-length messages attempts to free a scatter-gather list that was never allocated, resulting in invalid memory operations.

Why it matters to the business

Kernel instability or crashes on systems performing hash operations via AF_ALG sockets, increasing downtime risk in crypto-heavy workloads; low exploitation likelihood reduces immediate urgency despite widespread Linux kernel presence.

How an attack unfolds

An attacker opens an AF_ALG hash socket, submits a zero-length message, and forces an error condition that triggers the erroneous SGL free, potentially corrupting kernel memory structures.

How to fix it

Upgrade Linux kernel to a version containing commit 9c82920359b7c1eddaf72069bcfe0ffddf088cd0 or later stable release; rebuild and reboot affected systems.

How to confirm the fix worked

Verify kernel source contains the referenced commit or check running kernel version against fixed releases; test zero-length hash operations under error conditions post-upgrade.

Typical attack path

1. Open AF_ALG socket with hash type
2. Submit zero-length message via sendmsg
3. Trigger error path in algif_hash handling
4. Observe kernel memory corruption or crash

How to detect it

Search kernel logs for oops or panic messages referencing algif_hash or scatterlist free operations on zero-length inputs; examine crash dumps for unexpected kfree calls on unallocated SGL structures.

What your security team should do

• Apply kernel updates containing the fix commit within standard maintenance windows
• Monitor for kernel oops or panic logs involving algif_hash
• Review usage of AF_ALG interfaces in applications and consider alternatives if patching is delayed