CVE-2024-26946: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26946 is a vulnerability discovered in the Linux kernel's kprobes/x86 subsystem. The issue was identified when reading from an unsafe address in the arch_adjust_kprobe_addr() function, which occurs before verifying if the address is in text or not. The vulnerability was initially reported by Qiang Zhang and was disclosed on May 1, 2024 (NVD).

The vulnerability exists in the arch_adjust_kprobe_addr() function within the Linux kernel's x86 kprobes implementation. The function was attempting to read directly from an address before verifying its safety, which could lead to issues when accessing inaccessible data areas. The fix involves using copy_from_kernel_nofault() to safely read from potentially unsafe addresses. This vulnerability is a fix for a previous commit cc66bb914578 ("x86/ibt,kprobes: Cure sym+0 equals fentry woes") (Kernel Commit).

If exploited, this vulnerability can cause a kernel panic when a user specifies an inaccessible data area, potentially leading to system instability or denial of service (NVD).

The vulnerability was discovered by the Syzcaller bot, which reported that the issue could be triggered when a user specifies an inaccessible data area. The exploit requires the ability to interact with the kernel's kprobe functionality (Kernel Commit).

The issue has been fixed in the Linux kernel through a patch that implements proper address validation using copy_from_kernel_nofault(). The fix has been backported to various stable kernel versions and is available in updated kernel packages. Ubuntu has released fixes for version 24.04 LTS (noble) in linux 6.8.0-35.35 and other affected packages (Ubuntu Security).