CVE-2024-26900: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26900 is a memory leak vulnerability discovered in the Linux kernel's MD (Multiple Devices) driver. The vulnerability was disclosed on April 17, 2024, affecting Linux kernel versions from 5.3 up to (excluding) 6.7.11 and versions from 6.8 up to (excluding) 6.8.2. The issue occurs when kobject_add() fails in bind_rdev_to_array(), causing 'rdev->serial' to be allocated but not freed, resulting in a kernel memory leak (NVD).

The vulnerability is caused by a missing cleanup operation in the Linux kernel's MD driver. When the kobject_add() function fails during device binding in bind_rdev_to_array(), the allocated memory for 'rdev->serial' is not properly freed, leading to a kernel memory leak. The issue was traced back to the commit 963c555e75b0 which introduced mddev_create/destroy_wb_pool functionality. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a Denial of Service (DoS) condition through memory leakage in the kernel. The issue specifically affects the mdadm process, which is used for managing MD (Multiple Devices) RAID systems in Linux (NetApp Security).

The vulnerability requires local access and low privileges to exploit. It can be triggered through the mdadm utility when managing RAID devices. The issue has been confirmed to be exploitable in laboratory conditions, though no active exploits in the wild have been reported (NVD).

The vulnerability has been fixed in Linux kernel versions 6.7.11 and 6.8.2 and later. The fix involves adding a call to mddev_destroy_serial_pool() in the error path of bind_rdev_to_array() to properly clean up the allocated memory. Various Linux distributions have released patches for their respective kernel versions, including Ubuntu 22.04 LTS (5.15.0-118.128) and 24.04 LTS (6.8.0-35.35) (Ubuntu Security).