CVE-2024-26844

What it actually does

The block layer fails to sanitize SG_DXFER_TO_FROM_DEV requests, allowing an iov_iter to be passed to _copy_from_iter in the wrong direction and triggering a kernel warning when the same buffer is used for both copy-in and copy-out operations.

Why it matters to the business

Linux systems may experience kernel warnings or reduced stability during certain block-device I/O operations; widespread kernel deployments increase the number of affected hosts that must be updated.

How an attack unfolds

An attacker with local access crafts a block I/O request using the SG_DXFER_TO_FROM_DEV direction flag; the kernel constructs an iov_iter that the copy routines treat as bidirectional, resulting in the observed warning path.

How to fix it

Upgrade the Linux kernel to the commit 8fc80874103a5c20aebdc2401361aa01c817f75b or later stable releases that contain the iterator-direction fix; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 8fc80874103a5c20aebdc2401361aa01c817f75b; re-run the original syzkaller reproducer and verify the warning no longer occurs.

Typical attack path

1. Obtain local user privileges on a Linux host
2. Open a block device or submit an SG_IO request
3. Set the transfer direction to SG_DXFER_TO_FROM_DEV
4. Trigger the request to reach the block layer iterator logic

How to detect it

Search kernel logs for the exact warning string originating from _copy_from_iter; review audit logs for processes issuing SG_IO or block requests with unusual direction flags.

What your security team should do

• Prioritize kernel updates on all production Linux systems within standard change windows
• Monitor vendor advisories for backported fixes in distribution kernels
• Restrict unprivileged access to raw block devices where feasible