CVE-2024-26885

What it actually does

Integer overflow during power-of-two bucket calculation for DEVMAP_HASH on 32-bit architectures allows undefined behavior (left-shift by 32) when max_entries exceeds 0x80000000, resulting in kernel crash on map update.

Why it matters to the business

Local denial-of-service on 32-bit Linux systems that use BPF device maps with large entry counts; older kernels remain exposed despite low exploitation probability.

How an attack unfolds

An attacker with local access invokes bpf() to create a DEVMAP_HASH specifying max_entries greater than 0x80000000; the subsequent map update triggers the unchecked overflow during bucket rounding, crashing the kernel. The original report notes this was demonstrated via syzbot on arm32.

How to fix it

Upgrade to a kernel containing commit 1f5e352b9088211fa5eb4e1639cd365f4f7d2f65 or later; rebuild and deploy the fixed kernel on all 32-bit systems that use BPF device maps.

How to confirm the fix worked

Confirm kernel source contains the overflow check before the power-of-two rounding operation; attempt to create and update a DEVMAP_HASH with max_entries > 0x80000000 on a test 32-bit system and verify no crash occurs.

Typical attack path

1. Obtain local code execution on 32-bit Linux
2. Call bpf() syscall to allocate DEVMAP_HASH with max_entries > 0x80000000
3. Perform map update operation to trigger bucket-size calculation
4. Kernel performs undefined 32-bit left shift resulting in crash

How to detect it

Review kernel logs for oops or panic messages referencing devmap or bpf map allocation on 32-bit systems; correlate with processes that recently performed bpf syscalls with large map sizes.

What your security team should do

• Identify all 32-bit Linux deployments and schedule kernel updates containing the referenced commit
• Prioritize systems exposing BPF to untrusted local users
• Add the fixed commit hash to internal kernel build pipelines and CI tests
• Monitor for future BPF map-related patches in stable branches