CVE-2024-26706: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26706 affects the Linux kernel's exception handler implementation in the parisc architecture. The vulnerability was discovered and disclosed on April 3, 2024. The issue involves random data corruption that occurs when accessing user space memory if the compiler uses a different register than the specified register %r29 for the error code (Kernel Git).

The vulnerability stems from the exception handler's behavior where if the compiler chooses a register other than %r29 (defined in ASM_EXCEPTIONTABLE_REG), the fault handler will still store -EFAULT into %r29, potentially corrupting whatever data this register is used for. This issue was particularly observed in the emulate_ldd() function. The problem occurs because using %0 or %1 in inline assembly appears with a '%r' prefix, which the GNU assembler cannot convert to an integer (Kernel Git).

The vulnerability can lead to random data corruption in the Linux kernel when accessing user space memory. This occurs because the fault handler may corrupt register data by storing -EFAULT into a register that is being used for other purposes (Kernel Git).

The vulnerability requires specific conditions where the compiler chooses a different register than %r29 for error code handling. It primarily affects the parisc architecture's exception handling mechanism when accessing user space memory (Kernel Git).

A fix has been implemented that extends the __ex_table with an additional 32-word. The solution involves inserting an assembler instruction 'or %r0,%r0,%reg' where %reg references the register chosen by the compiler for the error return code. When an access failure occurs, the fault handler examines the opcode to determine which register should receive the -EFAULT value. This approach required removing the BUILDTIME_TABLE_SORT config option (Kernel Git).