CVE-2024-26901

What it actually does

Uninitialized kernel memory allocated via kmalloc() in do_sys_name_to_handle() is copied to userspace, leaking two bytes of kernel data through the name_to_handle_at syscall.

Why it matters to the business

Local users on affected Linux systems may obtain small amounts of sensitive kernel memory contents, potentially assisting escalation or further attacks on kernel-protected assets.

How an attack unfolds

A local attacker invokes the name_to_handle_at syscall with parameters that trigger the uninitialized allocation path; the kernel copies the structure containing two uninitialized bytes to the caller's buffer, exposing kernel memory contents without requiring special privileges beyond local access.

How to fix it

Upgrade the Linux kernel to a version containing commit 4bac28f441e3cc9d3f1a84c8d023228a68d8a7c1 or later; rebuild and reboot all affected hosts.

How to confirm the fix worked

Verify the running kernel includes commit 4bac28f441e3cc9d3f1a84c8d023228a68d8a7c1; confirm the source change replaces kmalloc with kzalloc in fs/fhandle.c; test the syscall no longer returns uninitialized bytes via KMSAN or similar instrumentation.

Typical attack path

1. Obtain local shell or process execution on target Linux system
2. Invoke name_to_handle_at syscall with crafted mount and path arguments
3. Read the returned file_handle structure to inspect the leaked bytes
4. Use leaked data to inform subsequent kernel exploitation attempts

How to detect it

Review system call audit logs or eBPF traces for repeated or anomalous invocations of name_to_handle_at from untrusted processes; kernel memory dumps or KMSAN reports showing the original allocation site may indicate prior exposure attempts.

What your security team should do

• Prioritize kernel upgrades on all internet-facing or multi-tenant Linux hosts within the next maintenance window
• Restrict untrusted local code execution where feasible until patches are applied
• Monitor for new stable kernel releases that backport the fix