CVE-2024-26906

What it actually does

The flaw allows a local BPF program using bpf_probe_read_kernel() on the vsyscall page to invoke copy_from_kernel_nofault(), which triggers an unhandled page fault because handle_page_fault() treats the address as user space; SMAP enforcement then causes a kernel oops instead of applying the expected fix-up.

Why it matters to the business

Attackers with local access can crash affected Linux systems, leading to denial of service, unplanned downtime, and potential loss of in-flight work on servers and endpoints running the vulnerable kernel.

How an attack unfolds

An attacker with local access loads a BPF program that calls bpf_probe_read_kernel against the vsyscall page; this reaches copy_from_kernel_nofault and __get_user_asm, generates a non-present page fault, and because the fault handler misclassifies the address the BPF fix-up is not applied, resulting in a kernel oops via SMAP.

How to fix it

Upgrade the Linux kernel to a version containing commit 6e4694e65b6db4c3de125115dd4f55848cc48381 or later; rebuild and reboot with the fixed kernel.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit; attempt to load and run a test BPF program that performs the probe read and verify no oops occurs.

Typical attack path

1. Obtain local access on a system running a vulnerable kernel
2. Compile or load a BPF program containing bpf_probe_read_kernel targeting the vsyscall address
3. Attach the program to a syscall tracepoint or perf event
4. Trigger execution to induce the page fault and kernel oops

How to detect it

Search kernel logs and dmesg for oops entries containing copy_from_kernel_nofault, vsyscall page fault at ffffffffff600000, and bpf_probe_read_kernel call traces.

• BUG: unable to handle page fault for address: ffffffffff600000
• copy_from_kernel_nofault+0x6f/0x110
• bpf_probe_read_kernel+0x1d/0x50
• #PF: supervisor read access in kernel mode

What your security team should do

• Prioritize kernel updates on all exposed systems
• Temporarily restrict unprivileged BPF program loading via sysctl where feasible
• Review system logs for prior oops entries matching the described fault