CVE-2024-26840: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26840 is a memory leak vulnerability discovered in the Linux kernel's cachefiles subsystem, specifically in the cachefiles_add_cache() function. The vulnerability was disclosed on April 17, 2024, affecting Linux kernel versions from 2.6.30 up to versions before 4.19.309, 5.4.271, 5.10.212, 5.15.151, 6.1.80, 6.6.19, and 6.7.7 (NVD).

The vulnerability manifests as a memory leak that occurs after unbinding /dev/cachefiles, where an unreferenced object of size 192 bytes remains allocated. The issue stems from improper handling of the cache_cred reference count in the cachefiles_daemon_unbind() function and cachefiles_add_cache() error branch. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to memory leaks in the Linux kernel, potentially causing system resource depletion over time. While it doesn't allow for information disclosure or system compromise, it can affect system availability through resource exhaustion (NVD).

The vulnerability requires local access and low privileges to exploit. The attack complexity is low, but user interaction is not required for exploitation. The scope is unchanged, meaning the impact is limited to the vulnerable component (NVD).

The vulnerability has been fixed by adding proper reference count handling for cache_cred in both cachefiles_daemon_unbind() and cachefiles_add_cache() functions. The fix has been implemented in various Linux kernel versions through patches. Users should update their Linux kernel to the latest patched version (Kernel Patch).