CVE-2024-26630: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26630 is a vulnerability in the Linux kernel's cachestat functionality, discovered in early 2024. The issue involves a potential read-after-free condition in the cache walk mechanism where the folio from the page cache's xarray is accessed to compute its page offset and check for dirty and writeback flags without holding a proper reference, allowing the folio to be concurrently released and reused as another folio/page/slab (Kernel Git).

The vulnerability exists in the cachestat implementation where the code accesses folio data without proper reference counting. The fix involves modifying the approach to use xarray's existing machinery for folio page offsets and dirty/writeback states instead of directly accessing the folio. This change also affects tmpfs files behavior, which now report zeroes in their dirty and writeback counters. This modification is considered acceptable since tmpfs doesn't follow conventional writeback cache behavior, as its pages are "cleaned" during swapout (Kernel Git).

The vulnerability could potentially lead to memory corruption or system instability due to the read-after-free condition in the kernel's memory management subsystem. The issue affects systems running vulnerable versions of the Linux kernel, particularly impacting the cachestat functionality (NVD).

The vulnerability was discovered and reported by Jann Horn, and has been confirmed to be exploitable through the cachestat syscall implementation. The issue stems from the original cachestat implementation introduced by commit cf264e1329fb (Kernel Git).

The vulnerability has been patched in the Linux kernel with a fix that modifies the cachestat implementation to use xarray's existing machinery instead of directly accessing folio data. The patch has been backported to various maintained kernel versions and is available through distribution updates, including Red Hat Enterprise Linux (Red Hat).