CVE-2024-26945: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26945 is a vulnerability in the Linux kernel's crypto IAA (Intel Accelerator Architecture) driver discovered on May 1, 2024. The vulnerability occurs when the number of CPUs is less than the number of IAA devices, causing a divide-by-zero error in the rebalance_wq_table() function (NVD, Ubuntu).

The vulnerability stems from a calculation error in the Linux kernel's IAA crypto driver. When nr_cpus < nr_iaa, the calculated cpus_per_iaa becomes 0, which leads to a divide-by-zero condition in the rebalance_wq_table() function. The issue has been assigned a CVSS v3.1 base score of 8.4 (HIGH) with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H by CISA-ADP (NVD).

The vulnerability could potentially lead to a system crash due to the divide-by-zero error when the specific conditions are met in systems using the Intel IAA crypto driver. This affects various Linux distributions including Ubuntu and Red Hat Enterprise Linux 9 (Red Hat).

The vulnerability requires local access to exploit and has been classified with a low attack complexity. No known exploits in the wild have been reported at this time (NVD).

A fix has been implemented that ensures cpus_per_iaa is set to 1 when nr_cpus < nr_iaa or when nr_iaa is 0. The patch has been merged into the Linux kernel and is available in updated versions. Various distributions have released patches, including Ubuntu 24.04 LTS (noble) which has fixed the issue in version 6.8.0-35.35 (Kernel Patch).