CVE-2024-26632: block: Fix iterating over an empty bio with bio_for_each_folio_all
In the Linux kernel, the following vulnerability has been resolved:
block: Fix iterating over an empty bio with bioforeachfolioall
If the bio contains no data, biofirstfolio() calls pagefolio() on a NULL pointer and oopses. Move the test that we've reached the end of the bio from bionextfolio() to biofirstfolio().
[axboe: add unlikely() to error case]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26632?
The severity of CVE-2024-26632 is classified as medium due to its potential to cause a system crash.
How do I fix CVE-2024-26632?
To fix CVE-2024-26632, update the Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.10-1, or 6.12.11-1.
What systems are affected by CVE-2024-26632?
CVE-2024-26632 affects the Debian Linux packages listed in the affected software section.
What does CVE-2024-26632 exploit?
CVE-2024-26632 exploits a flaw in the block layer of the Linux kernel, leading to a NULL pointer dereference.
Is CVE-2024-26632 actively being exploited?
There are currently no known active exploits for CVE-2024-26632 in the wild.