CVE-2024-26796

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.6.0

Description The vulnerability is related to a NULL pointer dereference in the Linux kernel's perf subsystem. It occurs when the ctr get width function is not defined for the legacy case, but is used in arch perf update userpage. This can cause a kernel crash when attempting to use the perf record command. The issue is specific to configurations where CONFIG RISCV PMU LEGACY=y and CONFIG RISCV PMU SBI=n.

Recommendations To resolve this issue, update the Linux kernel to a version where this vulnerability has been fixed. Ensure that the ctr get width function is properly defined for the legacy case to prevent the NULL pointer dereference. Additionally, consider disabling the perf subsystem or restricting its use until a patched version of the kernel is available.