{ "cveId": "CVE-2024-26688", "url": "https://patchblox.com/security/cve/CVE-2024-26688", "summary": "CVE-2024-26688 is fixed in 22 products on 1 platform, first by ALAS2023-2024-549, released February 29, 2024. It is not reported as exploited. Patch Radar priority: Routine.", "title": "linux: In the Linux kernel, the following vulnerability has been resolved: fs,hugetlb: fix NULL pointer dereference in huge...", "description": "In the Linux kernel, the following vulnerability has been resolved: fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super When configuring a hugetlb filesystem via the fsconfig() syscall, there is a possible NULL dereference in hugetlbfs_fill_super() caused by assigning NULL to ctx-\u003Ehstate in hugetlbfs_parse_param() when the requested pagesize is non valid. E.g: Taking the following steps: fd = fsopen(\u0022hugetlbfs\u0022, FSOPEN_CLOEXEC); fsconfig(fd, FSCONFIG_SET_STRING, \u0022pagesize\u0022, \u00221024\u0022, 0); fsconfig(fd, FSCONFIG_CMD_CREATE, NULL, NULL, 0); Given that the requested \u0022pagesize\u0022 is invalid, ctxt-\u003Ehstate will be replaced with NULL, losing its previous value, and we will print an error: ... ... case Opt_pagesize: ps = memparse(param-\u003Estring, \u0026rest); ctx-\u003Ehstate = h; if (!ctx-\u003Ehstate) { pr_err(\u0022Unsupported page size %lu MB\\n\u0022, ps / SZ_1M); return -EINVAL; } return 0; ... ... This is a problem because later on, we will dereference ctxt-\u003Ehstate in hugetlbfs_fill_super() ... ... sb-\u003Es_blocksize = huge_page_size(ctx-\u003Ehstate); ... ... Causing below Oops. Fix this by replacing cxt-\u003Ehstate value only when then pagesize is known to be valid. kernel: hugetlbfs: Unsupported page size 0 MB kernel: BUG: kernel NULL pointer dereference, address: 0000000000000028 kernel: #PF: supervisor read access in kernel mode kernel: #PF: error_code(0x0000) - not-present page kernel: PGD 800000010f66c067 P4D 800000010f66c067 PUD 1b22f8067 PMD 0 kernel: Oops: 0000 [#1] PREEMPT SMP PTI kernel: CPU: 4 PID: 5659 Comm: syscall Tainted: G E 6.8.0-rc2-default\u002B #22 5a47c3fef76212addcc6eb71344aabc35190ae8f kernel: Hardware name: Intel Corp. GROVEPORT/GROVEPORT, BIOS GVPRCRB1.86B.0016.D04.1705030402 05/03/2017 kernel: RIP: 0010:hugetlbfs_fill_super\u002B0xb4/0x1a0 kernel: Code: 48 8b 3b e8 3e c6 ed ff 48 85 c0 48 89 45 20 0f 84 d6 00 00 00 48 b8 ff ff ff ff ff ff ff 7f 4c 89 e7 49 89 44 24 20 48 8b 03 \u003C8b\u003E 48 28 b8 00 10 00 00 48 d3 e0 49 89 44 24 18 48 8b 03 8b 40 28 kernel: RSP: 0018:ffffbe9960fcbd48 EFLAGS: 00010246 kernel: RAX: 0000000000000000 RBX: ffff9af5272ae780 RCX: 0000000000372004 kernel: RDX: ffffffffffffffff RSI: ffffffffffffffff RDI: ffff9af555e9b000 kernel: RBP: ffff9af52ee66b00 R08: 0000000000000040 R09: 0000000000370004 kernel: R10: ffffbe9960fcbd48 R11: 0000000000000040 R12: ffff9af555e9b000 kernel: R13: ffffffffa66b86c0 R14: ffff9af507d2f400 R15: ffff9af507d2f400 kernel: FS: 00007ffbc0ba4740(0000) GS:ffff9b0bd7000000(0000) knlGS:0000000000000000 kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 kernel: CR2: 0000000000000028 CR3: 00000001b1ee0000 CR4: 00000000001506f0 kernel: Call Trace: kernel: \u003CTASK\u003E kernel: ? __die_body\u002B0x1a/0x60 kernel: ? page_fault_oops\u002B0x16f/0x4a0 kernel: ? search_bpf_extables\u002B0x65/0x70 kernel: ? fixup_exception\u002B0x22/0x310 kernel: ? exc_page_fault\u002B0x69/0x150 kernel: ? asm_exc_page_fault\u002B0x22/0x30 kernel: ? __pfx_hugetlbfs_fill_super\u002B0x10/0x10 kernel: ? hugetlbfs_fill_super\u002B0xb4/0x1a0 kernel: ? hugetlbfs_fill_super\u002B0x28/0x1a0 kernel: ? __pfx_hugetlbfs_fill_super\u002B0x10/0x10 kernel: vfs_get_super\u002B0x40/0xa0 kernel: ? __pfx_bpf_lsm_capable\u002B0x10/0x10 kernel: vfs_get_tree\u002B0x25/0xd0 kernel: vfs_cmd_create\u002B0x64/0xe0 kernel: __x64_sys_fsconfig\u002B0x395/0x410 kernel: do_syscall_64\u002B0x80/0x160 kernel: ? syscall_exit_to_user_mode\u002B0x82/0x240 kernel: ? do_syscall_64\u002B0x8d/0x160 kernel: ? syscall_exit_to_user_mode\u002B0x82/0x240 kernel: ? do_syscall_64\u002B0x8d/0x160 kernel: ? exc_page_fault\u002B0x69/0x150 kernel: entry_SYSCALL_64_after_hwframe\u002B0x6e/0x76 kernel: RIP: 0033:0x7ffbc0cb87c9 kernel: Code: 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003C48\u003E 3d 01 f0 ff ff 73 01 c3 48 8b 0d 97 96 0d 00 f7 d8 64 89 01 48 kernel: RSP: 002b:00007ffc29d2f388 EFLAGS: 00000206 ORIG_RAX: 00000000000001af kernel: RAX: fffffffffff ---truncated---", "published": "2024-02-29T10:29:00Z", "severity": "medium", "cvss": 5.5, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epss": 0.00245, "epssPercentile": 0.15747, "priority": "Routine", "priorityTier": 4, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "bpftool", "release": "amzn 2023", "fixedVersion": "6.1.79-99.164.amzn2023", "fix": "ALAS2023-2024-549", "url": "https://patchblox.com/security/fix/linux/alas2023-2024-549", "released": "2024-02-29T10:29:00Z" }, { "platform": "linux", "product": "bpftool-debuginfo", "release": "amzn 2023", "fixedVersion": "6.1.79-99.164.amzn2023", "fix": "ALAS2023-2024-549", "url": "https://patchblox.com/security/fix/linux/alas2023-2024-549", "released": "2024-02-29T10:29:00Z" }, { "platform": "linux", "product": "kernel", "release": "amzn 2023", "fixedVersion": "6.1.79-99.164.amzn2023", "fix": "ALAS2023-2024-549", "url": "https://patchblox.com/security/fix/linux/alas2023-2024-549", "released": "2024-02-29T10:29:00Z" }, { "platform": "linux", "product": "kernel-debuginfo", "release": "amzn 2023", "fixedVersion": "6.1.79-99.164.amzn2023", "fix": "ALAS2023-2024-549", "url": "https://patchblox.com/security/fix/linux/alas2023-2024-549", "released": "2024-02-29T10:29:00Z" }, { "platform": "linux", "product": "kernel-debuginfo-common-aarch64", "release": "amzn 2023", "fixedVersion": "6.1.79-99.164.amzn2023", "fix": "ALAS2023-2024-549", "url": "https://patchblox.com/security/fix/linux/alas2023-2024-549", "released": "2024-02-29T10:29:00Z" }, { "platform": "linux", "product": "kernel-debuginfo-common-x86_64", "release": "amzn 2023", "fixedVersion": "6.1.79-99.164.amzn2023", "fix": "ALAS2023-2024-549", "url": "https://patchblox.com/security/fix/linux/alas2023-2024-549", "released": "2024-02-29T10:29:00Z" }, { "platform": "linux", "product": "kernel-devel", "release": "amzn 2023", "fixedVersion": "6.1.79-99.164.amzn2023", "fix": "ALAS2023-2024-549", "url": "https://patchblox.com/security/fix/linux/alas2023-2024-549", "released": "2024-02-29T10:29:00Z" }, { "platform": "linux", "product": "kernel-headers", "release": "amzn 2023", "fixedVersion": "6.1.79-99.164.amzn2023", "fix": "ALAS2023-2024-549", "url": "https://patchblox.com/security/fix/linux/alas2023-2024-549", "released": "2024-02-29T10:29:00Z" }, { "platform": "linux", "product": "kernel-libbpf", "release": "amzn 2023", "fixedVersion": "6.1.79-99.164.amzn2023", "fix": "ALAS2023-2024-549", "url": "https://patchblox.com/security/fix/linux/alas2023-2024-549", "released": "2024-02-29T10:29:00Z" }, { "platform": "linux", "product": "kernel-libbpf-devel", "release": "amzn 2023", "fixedVersion": "6.1.79-99.164.amzn2023", "fix": "ALAS2023-2024-549", "url": "https://patchblox.com/security/fix/linux/alas2023-2024-549", "released": "2024-02-29T10:29:00Z" }, { "platform": "linux", "product": "kernel-libbpf-static", "release": "amzn 2023", "fixedVersion": "6.1.79-99.164.amzn2023", "fix": "ALAS2023-2024-549", "url": "https://patchblox.com/security/fix/linux/alas2023-2024-549", "released": "2024-02-29T10:29:00Z" }, { "platform": "linux", "product": "kernel-livepatch-6.1.79-99.164", "release": "amzn 2023", "fixedVersion": "1.0-0.amzn2023", "fix": "ALAS2023-2024-549", "url": "https://patchblox.com/security/fix/linux/alas2023-2024-549", "released": "2024-02-29T10:29:00Z" }, { "platform": "linux", "product": "kernel-modules-extra", "release": "amzn 2023", "fixedVersion": "6.1.79-99.164.amzn2023", "fix": "ALAS2023-2024-549", "url": "https://patchblox.com/security/fix/linux/alas2023-2024-549", "released": "2024-02-29T10:29:00Z" }, { "platform": "linux", "product": "kernel-modules-extra-common", "release": "amzn 2023", "fixedVersion": "6.1.79-99.164.amzn2023", "fix": "ALAS2023-2024-549", "url": "https://patchblox.com/security/fix/linux/alas2023-2024-549", "released": "2024-02-29T10:29:00Z" }, { "platform": "linux", "product": "kernel-tools", "release": "amzn 2023", "fixedVersion": "6.1.79-99.164.amzn2023", "fix": "ALAS2023-2024-549", "url": "https://patchblox.com/security/fix/linux/alas2023-2024-549", "released": "2024-02-29T10:29:00Z" }, { "platform": "linux", "product": "kernel-tools-debuginfo", "release": "amzn 2023", "fixedVersion": "6.1.79-99.164.amzn2023", "fix": "ALAS2023-2024-549", "url": "https://patchblox.com/security/fix/linux/alas2023-2024-549", "released": "2024-02-29T10:29:00Z" }, { "platform": "linux", "product": "kernel-tools-devel", "release": "amzn 2023", "fixedVersion": "6.1.79-99.164.amzn2023", "fix": "ALAS2023-2024-549", "url": "https://patchblox.com/security/fix/linux/alas2023-2024-549", "released": "2024-02-29T10:29:00Z" }, { "platform": "linux", "product": "linux", "release": "Debian 12.15 (bookworm)", "fixedVersion": "6.1.82-1", "fix": "DEBIAN-CVE-2024-26688", "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-26688", "released": "2024-04-03T15:15:52Z" }, { "platform": "linux", "product": "linux", "release": "Debian 13.5 (trixie)", "fixedVersion": "6.7.7-1", "fix": "DEBIAN-CVE-2024-26688", "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-26688", "released": "2024-04-03T15:15:52Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "6.7.7-1", "fix": "DEBIAN-CVE-2024-26688", "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-26688", "released": "2024-04-03T15:15:52Z" }, { "platform": "linux", "product": "perf", "release": "amzn 2023", "fixedVersion": "6.1.79-99.164.amzn2023", "fix": "ALAS2023-2024-549", "url": "https://patchblox.com/security/fix/linux/alas2023-2024-549", "released": "2024-02-29T10:29:00Z" }, { "platform": "linux", "product": "perf-debuginfo", "release": "amzn 2023", "fixedVersion": "6.1.79-99.164.amzn2023", "fix": "ALAS2023-2024-549", "url": "https://patchblox.com/security/fix/linux/alas2023-2024-549", "released": "2024-02-29T10:29:00Z" }, { "platform": "linux", "product": "python3-perf", "release": "amzn 2023", "fixedVersion": "6.1.79-99.164.amzn2023", "fix": "ALAS2023-2024-549", "url": "https://patchblox.com/security/fix/linux/alas2023-2024-549", "released": "2024-02-29T10:29:00Z" }, { "platform": "linux", "product": "python3-perf-debuginfo", "release": "amzn 2023", "fixedVersion": "6.1.79-99.164.amzn2023", "fix": "ALAS2023-2024-549", "url": "https://patchblox.com/security/fix/linux/alas2023-2024-549", "released": "2024-02-29T10:29:00Z" } ], "noFixYet": [], "dataAsOf": "2026-11-09T01:18:40Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }