CVE-2024-26632: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability was discovered in the Linux kernel's block subsystem affecting versions from 5.17 to 6.6.14, 6.7 to 6.7.2, and 6.2 to 6.2.14. The issue involves a NULL pointer dereference when iterating over an empty bio using the bio_for_each_folio_all() function. This vulnerability has been assigned CVE-2024-26632 and was discovered in January 2024 (NVD).

The vulnerability occurs in the block layer subsystem when bio_first_folio() calls page_folio() on a NULL pointer while processing an empty bio, resulting in a system crash. The fix involves moving the test that checks for the end of the bio from bio_next_folio() to bio_first_folio(). The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can cause a denial of service condition through a system crash (kernel oops) when processing empty bios in the block subsystem. The impact is limited to availability with no direct effects on confidentiality or integrity of the system (NVD).

The vulnerability requires local access with low complexity and low privileges to exploit. No evidence of active exploitation in the wild has been reported (NVD).

The vulnerability has been fixed in Linux kernel versions 6.6.14, 6.7.2, and 6.2.14. Various Linux distributions have released patches, including Ubuntu which has fixed the issue in multiple kernel packages including linux-oem-6.5 (6.5.0-1024.25), linux-oracle (6.5.0-1024.24), and others (Ubuntu Security).