CVE-2024-26705: 
Linux Debian vulnerability analysis and mitigation

CVE-2024-26705 affects the Linux kernel and involves a vulnerability in the parisc BTLB (Block Translation Lookaside Buffer) functionality. The issue was discovered and reported on April 3, 2024, specifically affecting the CPU bringup process on 32-bit parisc systems. The vulnerability occurs when setting up BTLB at CPU bringup during hotplug operations (Kernel Git).

The vulnerability stems from a write permission issue in the static btlb_info struct. When bringing up a 32-bit CPU using hotplug, the system needs to query firmware about BTLB information to set up static (block) TLB entries. However, since the btlb_info struct was marked with __ro_after_init annotation, the kernel would segfault due to missing write permissions when attempting to access this structure (Kernel Git).

When exploited, this vulnerability causes the kernel to crash (segfault) during CPU hotplug operations on affected parisc systems. The crash occurs specifically during the BTLB setup process when bringing up a 32-bit CPU (Kernel Git).

The vulnerability is triggered during specific hardware operations (CPU hotplug) on parisc architecture systems, particularly affecting 32-bit CPU configurations. The issue requires access to system hardware management capabilities to be exploited (Kernel Git).

The vulnerability has been fixed by removing the __ro_after_init annotation from the btlb_info struct. The fix was implemented through a patch that modifies the arch/parisc/kernel/cache.c file (Kernel Git).