CVE-2024-26884: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26884 affects the Linux kernel's BPF subsystem, specifically related to hashtab overflow checking on 32-bit architectures. The vulnerability was discovered in early 2024 and affects Linux kernel versions from 3.19 up to versions before 6.8.2 (NVD).

The vulnerability exists in the hashtab code which uses roundup_pow_of_two() to compute hash buckets. On 32-bit architectures, the roundup code can overflow when performing a 32-bit left-shift of an unsigned long value, resulting in undefined behavior. This issue was triggered by syzbot on the DEVMAP_HASH type. The CVSS v3.1 base score is 7.8 (High) with vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could potentially lead to privilege escalation, denial of service, or system crashes on affected 32-bit architectures due to the undefined behavior caused by the integer overflow (Kernel Patch).

The vulnerability requires local access with low privileges to exploit. No public exploits have been identified, though it was discovered through syzbot testing (NVD).

The issue has been fixed by moving the overflow check before the roundup operation in the hashtab code. The fix is available in Linux kernel version 6.8.2 and has been backported to various stable kernel versions. Users should update their kernel to a patched version (Kernel Patch).