CVE-2024-26871: 
Linux Debian vulnerability analysis and mitigation

CVE-2024-26871 is a NULL pointer dereference vulnerability discovered in the Linux kernel's F2FS (Flash-Friendly File System) implementation. The vulnerability affects Linux kernel versions from 6.5 up to (excluding) 6.6.23, from 6.7 up to (excluding) 6.7.11, and from 6.8 up to (excluding) 6.8.2. The issue was disclosed on April 17, 2024 (NVD).

The vulnerability occurs in the f2fs_submit_page_write() function where a race condition can lead to a NULL pointer dereference. When other threads have added a file I/O (fio) to io->bio and submitted it before entering f2fs_submit_page_write(), io->bio becomes NULL. If is_end_zone_blkaddr(sbi, fio->new_blkaddr) is true for this fio, a NULL pointer dereference occurs at bio_get(io->bio). The CVSS v3.1 base score is 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a denial of service condition through a kernel crash when triggered. The issue specifically affects systems using the F2FS file system with zoned block devices. The impact is limited to availability with no direct impact on confidentiality or integrity (NVD).

The vulnerability requires local access and low privileges to exploit. The attack complexity is low, but user interaction is not required. The vulnerability can be triggered through normal file system operations when specific conditions are met in the F2FS implementation (NVD).

The vulnerability has been fixed by moving the code for determining zone end before the "skip:" label to ensure it's executed for each fio. The fix is available in the Linux kernel patches. System administrators should update to Linux kernel versions 6.6.23, 6.7.11, or 6.8.2 or later to address this vulnerability (Kernel Patch).