CVE-2024-26883

What it actually does

The stackmap and DEVMAP_HASH code in the Linux kernel BPF subsystem performs an overflow check after calling roundup_pow_of_two() on an unsigned long; on 32-bit architectures this left-shift can produce undefined behavior instead of cleanly truncating to zero, allowing an attacker-supplied size to bypass the check and allocate or access memory beyond intended bounds.

Why it matters to the business

On 32-bit Linux systems, a local user with the ability to load BPF programs can trigger memory corruption that may lead to kernel crashes, privilege escalation, or arbitrary code execution, affecting servers, embedded devices, and Android kernels that have not been updated.

How an attack unfolds

An attacker crafts a BPF program that exercises the DEVMAP_HASH or stackmap creation path with a carefully chosen size; the flawed roundup on 32-bit hardware skips the overflow guard, resulting in an undersized or miscalculated hash table that later writes or reads out of bounds when the map is populated or looked up.

How to fix it

Update the Linux kernel to the commit c470abd4fde40ea6a0846a2beab642a578c0b8cd or later; rebuild and reboot all 32-bit systems; disable unprivileged BPF loading via sysctl kernel.unprivileged_bpf_disabled=1 where map creation by untrusted users is not required.

How to confirm the fix worked

Verify the running kernel contains commit c470abd4fde40ea6a0846a2beab642a578c0b8cd or a backport that performs the size check before rounding; attempt to load a test BPF program that previously triggered the overflow and confirm the kernel now rejects the invalid size.

Typical attack path

1. Obtain local access or a container with CAP_BPF or the ability to load unprivileged BPF programs
2. Load a malicious BPF program that triggers map creation with a size that causes the 32-bit roundup to overflow
3. Populate or manipulate the map to induce out-of-bounds memory operations
4. Escalate to kernel code execution or cause denial of service

How to detect it

Review kernel audit logs and BPF event traces for map creation failures or unusually large map allocations immediately preceding crashes; look for repeated attempts to create DEVMAP_HASH or stack maps from untrusted processes.

What your security team should do

• Prioritize patching all 32-bit Linux kernels within the next maintenance window
• Restrict BPF program loading to trusted processes only
• Monitor for local privilege-escalation attempts targeting BPF maps on 32-bit hosts
• Test the fixed kernel in staging environments before broad deployment