CVE-2024-26606

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the binder functionality in the Linux kernel. In (e)poll mode, threads depend on I/O events to determine when data is ready for consumption. A thread may initiate a command via BINDER WRITE READ without a read buffer and then use epoll wait() or similar to consume any responses afterwards. It is crucial that epoll threads are signaled via wakeup when they queue their own work. Otherwise, they risk waiting indefinitely for an event leaving their work unhandled. What is worse, subsequent commands won't trigger a wakeup either as the thread has pending work. The vulnerability is associated with uncontrolled resource consumption, which can be exploited by a remote attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.