CVE-2024-26884

What it actually does

The vulnerability is an incorrectly placed overflow check before roundup_pow_of_two() in BPF hashtab (and DEVMAP_HASH) bucket calculation; on 32-bit arches the left-shift inside roundup_pow_of_two() produces undefined behavior instead of truncation, allowing an attacker-controlled size to bypass the zero check and produce a corrupt map layout.

Why it matters to the business

Local attackers on 32-bit Linux systems (embedded devices, older servers, Android) can trigger kernel memory corruption, resulting in crashes, privilege escalation, or full host compromise; widespread kernel exposure amplifies operational risk even though EPSS remains low.

How an attack unfolds

A local attacker creates a BPF hash map or DEVMAP_HASH with a carefully chosen large size that forces the 32-bit roundup_pow_of_two() shift to overflow; because the zero-check occurs after the shift the corrupted bucket count is accepted, enabling subsequent out-of-bounds memory accesses that can be turned into arbitrary read/write.

How to fix it

Upgrade the Linux kernel to commit 33ec04cadb77605b71d9298311919303d390c4d5 or later; rebuild and reboot affected 32-bit systems; restrict unprivileged BPF map creation via sysctl kernel.unprivileged_bpf_disabled=1 until patched.

How to confirm the fix worked

Confirm kernel git commit >= 33ec04cadb77605b71d9298311919303d390c4d5; run existing syzbot reproducers targeting DEVMAP_HASH and hashtab on 32-bit builds; verify roundup_pow_of_two overflow check now precedes the shift.

Typical attack path

1. Obtain local unprivileged shell on 32-bit Linux kernel
2. Load or attach a BPF program that creates a hashtab/DEVMAP_HASH with attacker-chosen size
3. Trigger the roundup_pow_of_two() path to induce undefined shift behavior
4. Bypass the post-roundup zero check and obtain a malformed map
5. Leverage resulting memory corruption for privilege escalation or denial of service

How to detect it

Review audit logs and BPF event traces for creation of unusually large hash or devmap tables on 32-bit hosts; correlate with kernel oops/panic reports referencing hashtab or roundup_pow_of_two; inspect for post-exploit artifacts such as unexpected capability changes or new root processes.

What your security team should do

• Prioritize kernel updates on all 32-bit Linux assets within 30 days
• Disable unprivileged BPF where business functions permit
• Add kernel version checks to vulnerability scanning and asset inventory
• Monitor for local privilege-escalation attempts against 32-bit systems