CVE-2024-26786: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26786 is a vulnerability in the Linux kernel's IOMMU subsystem, specifically in the iommufd component. The issue was discovered when Syzkaller reported a WARN_ON condition in the io_pagetable.c file. The vulnerability stems from a mismatch between the access pointer in the list and the passed-in pointer, resulting from an overwrite of access->iopt_access_list_id in the iopt_add_access() function (Kernel Commit).

The vulnerability occurs when xa_alloc() succeeds but iopt_calculate_iova_alignment() fails in iommufd_access_change_ioas(). The bug manifests as an overwrite of the iopt_access_list_id field. According to CISA's assessment, this vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a system warning and potential system instability. The CVSS scoring indicates that while the vulnerability requires local access and low privileges, it can have a high impact on system availability (CISA-ADP).

The vulnerability requires local access with low privileges and no user interaction. It has been classified as a NULL Pointer Dereference issue (CWE-476) according to CISA's assessment (CISA-ADP).

The issue has been fixed in the Linux kernel through a patch that introduces a new_id variable in iopt_add_access() and only updates iopt_access_list_id when returning successfully. The fix has been committed to the kernel repository and is available in updated versions (Kernel Commit).