CVE-2024-26885: bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
The devmap code allocates a number hash buckets equal to the next power
of two of the max_entries value provided when creating the map. When
rounding up to the next power of two, the 32-bit variable storing the
number of buckets can overflow, and the code checks for overflow by
checking if the truncated 32-bit value is equal to 0. However, on 32-bit
arches the rounding up itself can overflow mid-way through, because it
ends up doing a left-shift of 32 bits on an unsigned long value. If the
size of an unsigned long is four bytes, this is undefined behaviour, so
there is no guarantee that we'll end up with a nice and tidy 0-value at
the end.
Syzbot managed to turn this into a crash on arm32 by creating a
DEVMAP_HASH with max_entries > 0x80000000 and then trying to update it.
Fix this by moving the overflow check to before the rounding up
operation.
Security readout for executives and security teams
Plain-English summary
A Linux BPF map-sizing flaw can crash affected 32-bit systems when an unusually large DEVMAP_HASH is created and updated. The demonstrated case affected arm32. Because exploitation requires local access and relevant BPF permissions, exposure depends heavily on system architecture and configuration.
Executive priority
Treat this as a high-priority kernel maintenance issue for exposed 32-bit systems, not evidence of an internet-wide emergency. Expedite vendor-approved updates where local or tenant workloads can access BPF. Systems running other architectures or tightly restricting BPF should still be inventoried and vendor-validated.
Technical view
DEVMAP_HASH rounds max_entries to a power-of-two bucket count. On 32-bit architectures, that calculation can perform an undefined 32-bit left shift before the existing overflow check. Syzbot demonstrated a kernel crash on arm32. The fix checks for overflow before rounding.
Likely exposure
Prioritize 32-bit Linux deployments, especially arm32, where local users or workloads can create and update BPF DEVMAP_HASH maps. The supplied metadata lists affected entries across 5.4–6.9, but downstream backports make version-only conclusions unreliable. Confirm status with each distribution or device vendor.
Exploitation context
The supplied CVSS is 7.8 and describes a local, low-complexity attack requiring low privileges and no user interaction. Syzbot demonstrated a crash, establishing denial-of-service potential. The bundle does not establish practical confidentiality or integrity impact, public weaponization, or active exploitation, and the CVE is not listed as KEV.
Researcher notes
The key defect is undefined behavior during power-of-two rounding on 32-bit unsigned long values; checking the truncated result afterward is unreliable. The correction moves overflow validation before rounding. Evidence confirms an arm32 crash with max_entries above 0x80000000, but does not establish code execution or impacts beyond availability.
Mitigation direction
Upgrade to a vendor-supported kernel containing the applicable upstream fix or backport.
Check distribution and device-vendor advisories before relying on kernel version numbers alone.
Prioritize remediation on 32-bit systems permitting relevant BPF map operations.
Where patching is delayed, follow vendor guidance for safely limiting local BPF access.
Validation and detection
Inventory Linux systems and identify those running 32-bit kernels, particularly arm32.
Record kernel package versions, architecture, and vendor patch status for each exposed system.
Verify the installed kernel includes the applicable fix or documented vendor backport.
Review which local users and workloads can perform relevant BPF map operations.
Monitor affected systems for unexplained kernel crashes while remediation is pending.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2024-26885 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
1CVSS vectors
3Timeline events
3ADP providers
12Source links
SSVC decision data
CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total
CVSS vector scores
1 official score
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.