CVE-2024-26731: 
Linux Kernel vulnerability analysis and mitigation

A NULL pointer dereference vulnerability was discovered in the Linux kernel's BPF sockmap implementation, specifically in the sk_psock_verdict_data_ready() function. The vulnerability (CVE-2024-26731) was reported by syzbot and affects the Linux kernel. The issue occurs when sk_psock_verdict_data_ready() and sk_psock_stop_verdict() are called concurrently, potentially causing psock->saved_data_ready to be NULL (Kernel Commit).

The vulnerability manifests as a NULL pointer dereference in the sk_psock_verdict_data_ready() function within net/core/skmsg.c. The issue arises from a race condition between sk_psock_verdict_data_ready() and sk_psock_stop_verdict() functions, where concurrent execution can lead to psock->saved_data_ready becoming NULL. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (NVD).

When exploited, this vulnerability can lead to a kernel NULL pointer dereference, potentially resulting in a system crash or denial of service condition. The issue affects the kernel's network stack functionality, specifically in the BPF sockmap implementation (Kernel Commit).

The vulnerability can be triggered through the network stack when using BPF sockmap functionality. A proof-of-concept has been demonstrated by syzbot, showing the NULL pointer dereference occurring during normal system operation (Kernel Commit).

The issue has been fixed by implementing proper synchronization using sk->sk_callback_lock and utilizing the sk_psock_data_ready() helper function. The fix has been merged into the Linux kernel and is available through the patch that adds appropriate locking mechanisms to prevent the race condition (Kernel Commit).