CVE-2024-26796: 
Linux Debian vulnerability analysis and mitigation

CVE-2024-26796 is a vulnerability in the Linux kernel affecting the performance monitoring unit (PMU) driver. The issue was discovered and disclosed on April 4, 2024, affecting Linux kernel versions from 6.6 through 6.6.21 and 6.7 through 6.7.9, as well as various release candidates of version 6.8. The vulnerability occurs when specific kernel configuration parameters (CONFIG_RISCV_PMU_LEGACY=y and CONFIG_RISCV_PMU_SBI=n) are set (NVD).

The vulnerability is caused by an undefined ctr_get_width function in the legacy PMU driver case, which is used in arch_perf_update_userpage. When attempting to use the 'perf record' command, this results in a NULL pointer dereference at virtual address 0x0, causing a kernel crash. The issue has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access requirements and potential high impact on availability (NVD).

When exploited, this vulnerability causes a kernel crash due to a NULL pointer dereference, leading to system instability and potential denial of service. The impact is particularly relevant when using performance monitoring tools, specifically when executing the 'perf record' command (NVD).

The vulnerability requires local access and specific kernel configuration parameters (CONFIG_RISCV_PMU_LEGACY=y and CONFIG_RISCV_PMU_SBI=n) to be exploitable. It can be triggered through normal usage of the perf tools, specifically when executing the 'perf record' command (NVD).

The vulnerability has been patched in the Linux kernel. The fix involves defining the ctr_get_width function for the legacy PMU driver and removing extra checks in riscv_pmu_ctr_get_width_mask. The patch has been committed to the kernel repository (Kernel Patch).