CVE-2024-26718 in Linux
Summary
by MITRE • 04/03/2024
In the Linux kernel, the following vulnerability has been resolved:
dm-crypt, dm-verity: disable tasklets
Tasklets have an inherent problem with memory corruption. The function tasklet_action_common calls tasklet_trylock, then it calls the tasklet callback and then it calls tasklet_unlock. If the tasklet callback frees the structure that contains the tasklet or if it calls some code that may free it, tasklet_unlock will write into free memory.
The commits 8e14f610159d and d9a02e016aaf try to fix it for dm-crypt, but it is not a sufficient fix and the data corruption can still happen [1].
There is no fix for dm-verity and dm-verity will write into free memory with every tasklet-processed bio.
There will be atomic workqueues implemented in the kernel 6.9 [2]. They
will have better interface and they will not suffer from the memory corruption problem.
But we need something that stops the memory corruption now and that can be backported to the stable kernels. So, I'm proposing this commit that disables tasklets in both dm-crypt and dm-verity. This commit doesn't remove the tasklet support, because the tasklet code will be reused when atomic workqueues will be implemented.
[1] https://lore.kernel.org/all/[email protected]/T/
[2] https://lore.kernel.org/lkml/[email protected]/
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/03/2025
The vulnerability described in CVE-2024-26718 represents a critical memory corruption issue within the Linux kernel's device mapper subsystem, specifically affecting dm-crypt and dm-verity implementations. This flaw stems from fundamental design limitations in the tasklet mechanism that has been deprecated due to its inherent instability. The vulnerability exists in the interaction between tasklet execution and memory management, where the tasklet_action_common function performs a sequence of operations that creates a window for memory corruption. The function first calls tasklet_trylock to acquire the tasklet lock, then executes the tasklet callback, and finally calls tasklet_unlock to release the lock. However, this sequence becomes problematic when the tasklet callback performs operations that result in the freeing of the tasklet structure itself, causing tasklet_unlock to write to memory that has already been deallocated.
The technical nature of this vulnerability aligns with CWE-121, which describes heap-based buffer overflow conditions, and CWE-416, which addresses use after free errors. The issue manifests when tasklet callbacks execute code that frees memory structures, including the tasklet itself, leading to undefined behavior and potential system instability. The dm-crypt implementation initially attempted to address this through commits 8e14f610159d and d9a02e016aaf, but these fixes proved insufficient to completely eliminate the corruption risk. More critically, dm-verity remains completely unaffected by any fixes, making it particularly dangerous as it processes every bio through tasklet execution, guaranteeing memory corruption on each operation. This vulnerability directly impacts the integrity of encrypted data and verification operations, potentially allowing attackers to manipulate or corrupt data at rest.
The operational impact of this vulnerability extends beyond simple memory corruption, as it fundamentally undermines the security guarantees provided by dm-crypt and dm-verity. Attackers could potentially exploit this weakness to bypass encryption protections or manipulate verification processes, leading to data integrity compromises. The vulnerability affects systems using device mapper implementations for encryption and data verification, which are common in enterprise environments, cloud deployments, and any system requiring secure data storage. The risk is particularly severe because the corruption occurs during normal operation of these security-critical subsystems, making detection difficult and the attack surface broad. This vulnerability also aligns with ATT&CK technique T1566, which covers phishing with malicious attachments, and T1070, which involves indicator removal on host, as compromised systems may exhibit subtle corruption patterns that could be mistaken for other issues.
The proposed solution of disabling tasklets in both dm-crypt and dm-verity represents a pragmatic approach to immediate risk mitigation while more comprehensive fixes are developed. This approach acknowledges that the underlying tasklet mechanism is fundamentally flawed and cannot be safely remediated through incremental patches. The fix maintains backward compatibility by preserving the tasklet code structure for future implementation of atomic workqueues, which are planned for kernel version 6.9. This design choice reflects the kernel development community's recognition that tasklets represent an outdated technology that requires replacement rather than repair. The approach also aligns with the principle of least privilege and defense in depth, ensuring that critical security subsystems operate without the risk of memory corruption that could compromise their integrity. Organizations should implement this fix immediately, particularly in environments where dm-crypt and dm-verity are actively used for data protection, as the vulnerability poses a direct threat to data security and system stability. The solution effectively eliminates the immediate risk while providing time for the transition to the more robust atomic workqueue implementation that will eventually replace the problematic tasklet infrastructure.