CVE-2024-26704 – A double-free vulnerability in the Linux kernel... (How to Fix)

Q: What is the severity of CVE-2024-26704?

CVE-2024-26704 has a CVSS score of 7.8 (HIGH). A double-free vulnerability in the Linux kernel's ext4 filesystem can lead to kernel panic and system crashes. This occurs when moving extents with overlapping preallocated blocks, causing a division-by-zero error during trim operations. Systems running vulnerable Linux kernel versions with ext4 filesystems are affected.

📋 TL;DR

A double-free vulnerability in the Linux kernel's ext4 filesystem can lead to kernel panic and system crashes. This occurs when moving extents with overlapping preallocated blocks, causing a division-by-zero error during trim operations. Systems running vulnerable Linux kernel versions with ext4 filesystems are affected.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific vulnerable versions not specified in CVE, but patches available for stable kernel branches

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires ext4 filesystem and use of EXT4_IOC_MOVE_EXT ioctl or similar extent moving operations.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system crash and kernel panic leading to denial of service, potentially causing data corruption or loss.

🟠

Likely Case

System instability and crashes when specific ext4 filesystem operations are performed, resulting in denial of service.

🟢

If Mitigated

Limited impact if systems don't use ext4 move extent operations or have restricted user access to these operations.

🌐 Internet-Facing: LOW - Requires local access and specific filesystem operations.

🏢 Internal Only: MEDIUM - Local users or processes with appropriate permissions could trigger the vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to perform specific filesystem operations. Not easily weaponized for remote exploitation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patched in stable kernel versions via commits referenced in CVE

Vendor Advisory: https://git.kernel.org/stable/c/185eab30486ba3e7bf8b9c2e049c79a06ffd2bc1

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version. 2. Check distribution-specific security advisories. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Restrict EXT4_IOC_MOVE_EXT access

linux

Limit access to the move extent ioctl operation through SELinux/AppArmor policies or capability restrictions.

# Use capabilities to restrict: setcap -r /path/to/binary
# Or use SELinux: semanage boolean --modify --off allow_ext4_move_extent

🧯 If You Can't Patch

Implement strict access controls to prevent unauthorized users from performing filesystem operations
Monitor for system crashes or kernel panics and implement robust backup/recovery procedures

🔍 How to Verify

Check if Vulnerable:

Check kernel version and verify if patches from referenced commits are applied: uname -r and review kernel source/git history

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated beyond patched commits and test ext4 move operations in controlled environment

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
Division by zero errors in kernel logs
Filesystem corruption warnings

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND ("division by zero" OR "panic" OR "ext4" AND "error")

📊 Metadata

CVE ID: CVE-2024-26704

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-415

Published: April 3, 2024

Last Updated: January 14, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-26704, you might also want to check these: