CVE-2024-26983: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26983 is a use-after-free vulnerability discovered in the Linux kernel's bootconfig subsystem. The issue affects Linux kernel versions from 5.15 up to versions before 6.1.88, 6.2 to before 6.6.29, 6.7 to before 6.8.8, and 6.9-rc1 through 6.9-rc3. The vulnerability was identified and disclosed in early 2024, with a fix being implemented in April 2024 (NVD).

The vulnerability occurs in the bootconfig (xbc) memory management system when freeing xbc memory in xbc_exit(). The issue arises because memblock may have already handed over memory to the buddy allocator, making it inappropriate to free memory back to memblock. The memblock_free() call by xbc_exit() causes use-after-free bugs on architectures with CONFIG_ARCH_KEEP_MEMBLOCK disabled, such as x86. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could allow an attacker with local access to cause a use-after-free condition in the kernel's memory management system. This could potentially lead to privilege escalation, system crashes, or arbitrary code execution in the context of the kernel (NVD).

The vulnerability requires local access and low privileges to exploit. It has been demonstrated to be reliably triggerable on x86 architectures with CONFIG_ARCH_KEEP_MEMBLOCK disabled, as evidenced by KASAN (Kernel Address Sanitizer) logs showing the use-after-free condition (Kernel Patch).

The vulnerability has been fixed by modifying the memory freeing mechanism in the bootconfig subsystem. The patch implements a solution that calls memblock_free() in the early xbc init error rewind path and memblock_free_late() in the xbc exit path to properly free memory to the buddy allocator. Users should upgrade to Linux kernel versions 6.1.88, 6.6.29, 6.8.8 or later, depending on their kernel series (Kernel Patch).