CVE-2024-26861: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26861 is a data-race vulnerability identified in the Linux kernel's WireGuard implementation, specifically in the receiving counter handling. The issue was discovered by Syzkaller with KCSAN when accessing keypair->receiving_counter.counter. The vulnerability was first reported on April 17, 2024, and has been resolved through the implementation of READ_ONCE() and WRITE_ONCE() annotations to mark the data race as intentional (Kernel Git).

The vulnerability manifests as a data race between wg_packet_decrypt_worker and wg_packet_rx_poll functions in the WireGuard receive handling code. The race condition occurs during concurrent access to the receiving_counter.counter field, where one CPU performs a write operation while another performs a read operation. The issue stems from the original code introduced in commit a9e90d9931f3 ("wireguard: noise: separate receive counter from send counter") (Kernel Git).

While the data race could potentially lead to inconsistent counter values in the WireGuard subsystem, the actual impact appears to be limited as the fix involves properly annotating intentional concurrent access rather than addressing an unintended race condition. The vulnerability affects systems running the Linux kernel with WireGuard support enabled (NVD).

The vulnerability requires local access to a system running the affected Linux kernel version with WireGuard enabled. No public exploits have been reported, and the nature of the fix (adding memory barrier annotations) suggests that practical exploitation would be difficult (NVD).

The issue has been fixed by adding proper memory barrier annotations (READ_ONCE() and WRITE_ONCE()) to the affected code paths in the WireGuard receive handling. Users should update their Linux kernel to a version containing the fix. The patch has been backported to various stable kernel versions (Kernel Git).