CVE-2024-26947

What it actually does

The vulnerability causes a kernel panic on ARM when remap_pfn_range calls set_pte_at for a reserved but unmapped PFN, because b15_flush_kern_dcache_area is invoked without first verifying PG_reserved after pfn_valid semantics changed.

Why it matters to the business

ARM Linux systems using UIO devices with certain memory layouts can suffer sudden kernel crashes and reboots, disrupting embedded devices, appliances, and any workloads relying on direct hardware memory mapping.

How an attack unfolds

A local process opens a UIO device whose memory region overlaps reserved unmapped ranges, performs an mmap that reaches remap_pfn_range, and triggers the invalid cache flush path that dereferences a non-existent mapping, resulting in a fatal paging fault and panic.

How to fix it

Apply the upstream fix in commit d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 or upgrade to a kernel containing that commit; rebuild and reboot affected ARM systems.

How to confirm the fix worked

Confirm the PG_reserved check exists in the flush routine of the running kernel source or binary; re-test the original UIO mmap scenario to ensure it no longer panics.

Typical attack path

1. Locate or configure a UIO device exposing a reserved PFN range
2. Call mmap on the UIO device from userspace
3. Kernel executes remap_pfn_range → set_pte_at → __sync_icache_dcache → b15_flush_kern_dcache_area
4. Flush instruction faults on unmapped address, producing kernel paging request and panic

How to detect it

Search kernel logs and crash dumps for the exact stack trace containing b15_flush_kern_dcache_area, __sync_icache_dcache, remap_pfn_range, and uio_mmap; correlate with processes performing UIO mmaps.

• b15_flush_kern_dcache_area+0x24/0x3c
• Unable to handle kernel paging request at virtual address bff00000
• uio_mmap+0x184/0x1b8 [uio]
• Kernel panic - not syncing: Fatal exception

What your security team should do

• Upgrade ARM kernels to the fixed commit on all affected devices
• Restrict unprivileged access to UIO character devices
• Add kernel panic signatures to monitoring and alerting rules