LiveActive security incident?Get immediate response
CVE Record

CVE-2024-26885: bpf: Fix DEVMAP_HASH overflow check on 32-bit arches

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix DEVMAP_HASH overflow check on 32-bit arches The devmap code allocates a number hash buckets equal to the next power of two of the max_entries value provided when creating the map. When rounding up to the next power of two, the 32-bit variable storing the number of buckets can overflow, and the code checks for overflow by checking if the truncated 32-bit value is equal to 0. However, on 32-bit arches the rounding up itself can overflow mid-way through, because it ends up doing a left-shift of 32 bits on an unsigned long value. If the size of an unsigned long is four bytes, this is undefined behaviour, so there is no guarantee that we'll end up with a nice and tidy 0-value at the end. Syzbot managed to turn this into a crash on arm32 by creating a DEVMAP_HASH with max_entries > 0x80000000 and then trying to update it. Fix this by moving the overflow check to before the rounding up operation.

HighCVSS 7.8Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux BPF map-sizing flaw can crash affected 32-bit systems when an unusually large DEVMAP_HASH is created and updated. The demonstrated case affected arm32. Because exploitation requires local access and relevant BPF permissions, exposure depends heavily on system architecture and configuration.

Executive priority

Treat this as a high-priority kernel maintenance issue for exposed 32-bit systems, not evidence of an internet-wide emergency. Expedite vendor-approved updates where local or tenant workloads can access BPF. Systems running other architectures or tightly restricting BPF should still be inventoried and vendor-validated.

Technical view

DEVMAP_HASH rounds max_entries to a power-of-two bucket count. On 32-bit architectures, that calculation can perform an undefined 32-bit left shift before the existing overflow check. Syzbot demonstrated a kernel crash on arm32. The fix checks for overflow before rounding.

Likely exposure

Prioritize 32-bit Linux deployments, especially arm32, where local users or workloads can create and update BPF DEVMAP_HASH maps. The supplied metadata lists affected entries across 5.4–6.9, but downstream backports make version-only conclusions unreliable. Confirm status with each distribution or device vendor.

Exploitation context

The supplied CVSS is 7.8 and describes a local, low-complexity attack requiring low privileges and no user interaction. Syzbot demonstrated a crash, establishing denial-of-service potential. The bundle does not establish practical confidentiality or integrity impact, public weaponization, or active exploitation, and the CVE is not listed as KEV.

Researcher notes

The key defect is undefined behavior during power-of-two rounding on 32-bit unsigned long values; checking the truncated result afterward is unreliable. The correction moves overflow validation before rounding. Evidence confirms an arm32 crash with max_entries above 0x80000000, but does not establish code execution or impacts beyond availability.

Mitigation direction

  • Upgrade to a vendor-supported kernel containing the applicable upstream fix or backport.
  • Check distribution and device-vendor advisories before relying on kernel version numbers alone.
  • Prioritize remediation on 32-bit systems permitting relevant BPF map operations.
  • Where patching is delayed, follow vendor guidance for safely limiting local BPF access.

Validation and detection

  • Inventory Linux systems and identify those running 32-bit kernels, particularly arm32.
  • Record kernel package versions, architecture, and vendor patch status for each exposed system.
  • Verify the installed kernel includes the applicable fix or documented vendor backport.
  • Review which local users and workloads can perform relevant BPF map operations.
  • Monitor affected systems for unexplained kernel crashes while remediation is pending.
Prepared
Confidence
medium
Sources
4

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-26885 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
3ADP providers
12Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-26885Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container
siemens-SADPADP container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux6f9d451ab1a33728adb72d7ff66a7b374d665176, 6f9d451ab1a33728adb72d7ff66a7b374d665176, 6f9d451ab1a33728adb72d7ff66a7b374d665176, 6f9d451ab1a33728adb72d7ff66a7b374d665176, 6f9d451ab1a33728adb72d7ff66a7b374d665176, 6f9d451ab1a33728adb72d7ff66a7b374d665176, 6f9d451ab1a33728adb72d7ff66a7b374d665176, 6f9d451ab1a33728adb72d7ff66a7b374d665176unaffected
LinuxLinux5.4, 0, 5.4.285, 5.10.227, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.