CVE-2024-26946

What it actually does

The flaw permits arch_adjust_kprobe_addr() to read from an arbitrary unsafe kernel address via direct access before any text-section validation occurs, triggering a kernel panic on inaccessible memory.

Why it matters to the business

Local denial-of-service crashes on Linux systems can interrupt services, require reboots, and create unplanned downtime; low exploitability keeps widespread impact limited despite high prevalence of the kernel.

How an attack unfolds

A local attacker invokes kprobe registration with an address outside valid kernel text (for example via crafted user-space input or a fuzzer), causing arch_adjust_kprobe_addr() to dereference the unsafe pointer and panic the kernel before any safety check.

How to fix it

Apply the upstream fix commit 6417684315087904fffe8966d27ca74398c57dd6 or later stable kernels; on Debian systems ensure vsftpd packages are at least version 2.3.4-1 where kernel updates are included.

How to confirm the fix worked

Confirm the running kernel contains commit 6417684315087904fffe8966d27ca74398c57dd6; attempt to reproduce the syzkaller-reported kprobe case and verify no panic occurs.

Typical attack path

1. Obtain local user access on a Linux system
2. Register a kprobe with an inaccessible or non-text kernel address
3. arch_adjust_kprobe_addr() performs unsafe read
4. Kernel page fault or panic occurs

How to detect it

Review kernel logs for oops/panic entries referencing arch_adjust_kprobe_addr or kprobes; correlate with process activity that registers kprobes shortly before the crash.

What your security team should do

• Prioritize kernel updates on all production Linux hosts within standard change windows
• Monitor EPSS and threat-intel feeds for any rise in local exploit tooling
• Restrict untrusted local accounts from kprobe or ftrace interfaces where feasible