CVE-2024-26849: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26849 is a vulnerability discovered in the Linux kernel's netlink component. The issue stems from missing size validations for big-endian integer types NLA_BE16 and NLA_BE32 in the minlen array. The vulnerability was disclosed on April 17, 2024, affecting Linux kernel versions from 6.1 up to 6.8 RC3 (NVD).

The vulnerability occurs in the netlink attribute validation code where NLA_BE32 size in minlen array is set to 0, causing the validation code to read past malformed (too small) attributes. This specifically affects the parsing of netlink messages when handling attributes like NFTA_TARGET_REV with NLA_POLICY_MAX(NLA_BE32, 255). The issue has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to reading past malformed attributes in the Linux kernel's netlink component, potentially causing system instability or denial of service conditions (Kernel Patch).

The vulnerability requires local access and low privileges to exploit. It was discovered through KMSAN (Kernel Memory Sanitizer) testing, which detected uninitialized value usage in various netlink attribute validation functions (Kernel Patch).

The issue has been fixed by adding proper size definitions for NLA_BE16 and NLA_BE32 types in the minlen array. The fix has been implemented in the Linux kernel through a patch that adds the appropriate size validations (Kernel Patch).