CVE-2024-26973: 
Git vulnerability analysis and mitigation

CVE-2024-26973 affects the Linux kernel's FAT filesystem handling, specifically in the fat_encode_fh_nostale() function. The vulnerability was discovered on May 1, 2024, and involves an uninitialized field in nostale filehandles. When encoding a file handle without a parent, the function stores only the first 10 bytes while the actual file handle length must be a multiple of 4 (12 bytes), leaving two bytes uninitialized (NVD).

The vulnerability exists in the fat_encode_fh_nostale() function where file handles are encoded. When handling a file without a parent, the function only initializes 10 bytes of data, but due to alignment requirements, the file handle is actually 12 bytes long. This leaves two bytes uninitialized, potentially leaking uninitialized kernel memory to userspace. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability could lead to information disclosure as uninitialized kernel memory might be exposed to userspace applications through the uninitialized bytes in the file handle (Kernel Patch).

The vulnerability requires local access and can be triggered through filesystem operations involving FAT filesystems. It was initially reported by the syzkaller automated testing system (Kernel Patch).

The vulnerability has been fixed by properly initializing the full handle length in the fat_encode_fh_nostale() function. The fix has been incorporated into various Linux kernel versions including 5.10.216, 5.15.154, and 6.1.84 (Ubuntu Security).