CVE-2024-26920

What it actually does

Incorrect return value in register_snapshot_trigger() allows registration of snapshot trigger despite failed memory allocation for snapshot, potentially leading to null pointer dereference or kernel panic on use.

Why it matters to the business

Linux kernel systems using tracing with snapshot triggers risk crashes or instability during debugging or monitoring, impacting operational reliability across a vast number of deployments.

How an attack unfolds

A local attacker interacts with the tracing subsystem to register a snapshot trigger while forcing an allocation failure; the trigger registers as successful without a valid snapshot, enabling subsequent operations to dereference invalid memory and crash the kernel.

How to fix it

Update the Linux kernel to include commit 3d77e6a8804abcc0504c904bd6e5cdf3a5cf8162 or any later version that properly returns error codes from register_snapshot_trigger().

How to confirm the fix worked

Confirm the fix commit is present in the kernel source tree or verify through code inspection and testing that register_snapshot_trigger() now returns a non-zero error on allocation failure.

Typical attack path

1. Obtain local user access on a Linux system
2. Access the tracing subsystem via debugfs or perf
3. Register a snapshot trigger under memory pressure to trigger allocation failure
4. Activate the trigger to induce kernel fault or denial of service

How to detect it

Review kernel logs and dmesg output for unexpected success returns during snapshot trigger registration or subsequent faults in the tracing subsystem.

What your security team should do

• Prioritize kernel upgrades containing the referenced commit
• Restrict unprivileged access to tracing interfaces where feasible
• Monitor kernel logs for tracing-related oops or allocation failures