CVE-2024-26983

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37

Description A vulnerability in the Linux kernel has been resolved, related to the bootconfig feature. The issue occurs when freeing xbc memory in the xbc exit() function, where memblock may have already handed over memory to the buddy allocator. This can cause use-after-free (UAF) bugs on architectures with CONFIG ARCH KEEP MEMBLOCK disabled, such as x86. The patch fixes this problem by calling memblock free() in the early xbc init error rewind path and memblock free late() in the xbc exit path to free memory to the buddy allocator.

Recommendations To resolve this issue, update the Linux kernel to version 6.6.37 or later. If updating is not possible, consider temporarily disabling the bootconfig feature or restricting access to the vulnerable memory area until a patch can be applied.