CVE-2024-26763

Q: What is the severity of CVE-2024-26763?

CVE-2024-26763 has a CVSS score of 7.1 (HIGH). A race condition vulnerability in the Linux kernel's dm-crypt subsystem when using authenticated encryption (AEAD) allows data corruption. Attackers with local access could modify data during O_DIRECT writes, causing invalid authentication tags that corrupt encrypted storage. This affects Linux systems using dm-crypt with authenticated encryption modes like GCM or CCM.

7.1 HIGH

📋 TL;DR

A race condition vulnerability in the Linux kernel's dm-crypt subsystem when using authenticated encryption (AEAD) allows data corruption. Attackers with local access could modify data during O_DIRECT writes, causing invalid authentication tags that corrupt encrypted storage. This affects Linux systems using dm-crypt with authenticated encryption modes like GCM or CCM.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when using dm-crypt with authenticated encryption (AEAD) modes and O_DIRECT writes. Standard encryption modes are not affected.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Permanent data corruption on encrypted storage devices, potentially rendering systems unbootable or causing data loss.

🟠

Likely Case

Local attackers could corrupt specific files or partitions by exploiting concurrent O_DIRECT write operations.

🟢

If Mitigated

With proper access controls, only authorized users could trigger the corruption, limiting scope to their permissions.

🌐 Internet-Facing: LOW - Requires local access to the system.

🏢 Internal Only: MEDIUM - Local users or processes could exploit this to corrupt data, but requires specific conditions.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and specific timing conditions during concurrent O_DIRECT write operations.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 0dccbb93538f, 1a4371db68a3, 3c652f6fa1e1, 43a202bd5529, or 50c70240097c

Vendor Advisory: https://git.kernel.org/stable/c/0dccbb93538fe89a86c6de31d4b1c8c560848eaa

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel. 3. Verify kernel version matches patched release.

🔧 Temporary Workarounds

Disable authenticated encryption

linux

Use non-authenticated encryption modes (like CBC, XTS) instead of AEAD modes (GCM, CCM)

# Reconfigure dm-crypt to use non-AEAD cipher (e.g., aes-xts-plain64 instead of aes-gcm-random)

Avoid O_DIRECT writes

linux

Configure applications to avoid O_DIRECT flag when writing to encrypted devices

🧯 If You Can't Patch

Restrict local user access to systems using dm-crypt with authenticated encryption
Monitor for unusual storage corruption events and maintain verified backups

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if dm-crypt with authenticated encryption is in use: 'uname -r' and 'dmsetup table --target crypt'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits and test O_DIRECT writes to encrypted devices don't cause corruption

📡 Detection & Monitoring

Log Indicators:

Kernel logs showing dm-crypt authentication failures
Storage corruption errors in system logs
Filesystem inconsistency reports

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND ("dm-crypt" OR "authentication failure")

📊 Metadata

CVE ID: CVE-2024-26763

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CWE: CWE-787

Published: April 3, 2024

Last Updated: March 18, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable authenticated encryption

Avoid O_DIRECT writes

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities