CVE-2024-26793: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26793 affects the Linux kernel's GTP (GPRS Tunneling Protocol) module, specifically in the gtp_newlink() function. The vulnerability was discovered and reported in early 2024, affecting Linux kernel versions from 4.7 through 6.8-rc6. The issue involves both a use-after-free condition and a null pointer dereference in the GTP module (NVD).

The vulnerability stems from an incorrect registration order of operations structures in the GTP module. The gtp_link_ops operations structure was being registered before the gtp_net_ops pernet operations structure, leading to potential use-after-free and null pointer dereference conditions. The issue manifests as a general protection fault in the gtp_genl_dump_pdp function. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability can lead to a denial of service condition through kernel crashes, and potentially allows for arbitrary code execution with elevated privileges. The issue affects systems running the Linux kernel with the GTP module enabled (NVD).

The vulnerability requires local access and low privileges to exploit. It was discovered through the Syzkaller kernel fuzzer, which triggered a 'general protection fault in gtp_genl_dump_pdp' bug in kernel version 6.8.0-rc6 (Kernel Patch).

The vulnerability has been fixed by modifying the registration order in the GTP module initialization. The fix ensures that gtp_net_ops pernet operations structure is registered before the gtp_link_ops operations structure. The patch has been backported to multiple stable kernel versions (Kernel Patch).