CVE-2024-26947 in Linux
Summary
by MITRE • 05/01/2024
In the Linux kernel, the following vulnerability has been resolved:
ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
Since commit a4d5613c4dc6 ("arm: extend pfn_valid to take into account freed memory map alignment") changes the semantics of pfn_valid() to check presence of the memory map for a PFN. A valid page for an address which is reserved but not mapped by the kernel[1], the system crashed during
some uio test with the following memory layout:
node 0: [mem 0x00000000c0a00000-0x00000000cc8fffff]
node 0: [mem 0x00000000d0000000-0x00000000da1fffff]
the uio layout is：0xc0900000, 0x100000
the crash backtrace like:
Unable to handle kernel paging request at virtual address bff00000 [...]
CPU: 1 PID: 465 Comm: startapp.bin Tainted: G O 5.10.0 #1 Hardware name: Generic DT based system PC is at b15_flush_kern_dcache_area+0x24/0x3c LR is at __sync_icache_dcache+0x6c/0x98 [...]
(b15_flush_kern_dcache_area) from (__sync_icache_dcache+0x6c/0x98) (__sync_icache_dcache) from (set_pte_at+0x28/0x54) (set_pte_at) from (remap_pfn_range+0x1a0/0x274) (remap_pfn_range) from (uio_mmap+0x184/0x1b8 [uio])
(uio_mmap [uio]) from (__mmap_region+0x264/0x5f4)
(__mmap_region) from (__do_mmap_mm+0x3ec/0x440) (__do_mmap_mm) from (do_mmap+0x50/0x58) (do_mmap) from (vm_mmap_pgoff+0xfc/0x188) (vm_mmap_pgoff) from (ksys_mmap_pgoff+0xac/0xc4) (ksys_mmap_pgoff) from (ret_fast_syscall+0x0/0x5c) Code: e0801001 e2423001 e1c00003 f57ff04f (ee070f3e) ---[ end trace 09cf0734c3805d52 ]---
Kernel panic - not syncing: Fatal exception
So check if PG_reserved was set to solve this issue.
[1]: https://lore.kernel.org/lkml/[email protected]/
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 01/26/2026
The vulnerability CVE-2024-26947 represents a critical kernel panic issue affecting ARM-based Linux systems where the kernel fails to properly validate memory mappings during device driver operations. This flaw occurs in the context of UIO (User Space I/O) subsystem functionality where memory mapping operations attempt to access reserved but unmapped memory regions. The issue stems from changes made to the pfn_valid() function in commit a4d5613c4dc6, which altered how the kernel determines valid page frame numbers by incorporating memory map presence checks. When a UIO operation attempts to map a memory region that is reserved but not mapped by the kernel, the system crashes with a kernel paging request error at virtual address bff00000, indicating an invalid memory access pattern. The crash occurs during cache flushing operations specifically in the b15_flush_kern_dcache_area function, which is part of the ARM-specific kernel memory management subsystem.
The technical root cause involves improper handling of page flags during memory mapping operations, particularly when dealing with pages marked as PG_reserved. The kernel's memory management subsystem fails to verify that a page is not only valid but also properly mapped before attempting cache operations on it. This creates a scenario where the system attempts to flush cache areas for memory that is reserved but not actually mapped to the kernel's virtual address space, leading to a page fault exception. The vulnerability manifests when the UIO subsystem calls remap_pfn_range function, which eventually leads to set_pte_at and ultimately triggers the cache synchronization function __sync_icache_dcache. The backtrace shows a clear call chain from UIO mmap operations through memory mapping functions to the final cache flush operation that causes the system to panic.
This vulnerability directly impacts system stability and security by creating a potential denial-of-service condition that could be exploited by malicious users or applications to crash the kernel. The issue affects ARM-based systems running kernel versions that include the problematic commit, particularly those using UIO subsystem for device driver operations. From an ATT&CK perspective, this vulnerability could be leveraged for privilege escalation or system compromise if exploited properly, as it allows for kernel memory corruption through legitimate user-space operations. The vulnerability aligns with CWE-125: Out-of-bounds Read, as the kernel attempts to access memory outside of its intended boundaries, and CWE-248: Uncaught Exception, since the kernel fails to properly handle the invalid memory access condition. The impact is significant because it affects the core memory management functionality of the kernel, potentially allowing for arbitrary code execution or complete system compromise.
The mitigation strategy involves implementing proper validation checks for reserved pages before performing cache operations, specifically checking if the PG_reserved flag is set before proceeding with memory mapping operations. The fix requires modifying the kernel code to ensure that when pfn_valid() returns true for a page, the system also verifies that the page is properly mapped and not merely reserved. This approach aligns with the principle of least privilege and proper input validation, ensuring that kernel operations only proceed when memory regions are actually valid and accessible. System administrators should apply the relevant kernel patches that implement this validation check, particularly on ARM systems where UIO operations are frequently used. The fix ensures that reserved memory regions, which are typically used for special purposes like device drivers or kernel modules, are not inadvertently accessed during normal memory mapping operations, thereby preventing the kernel panic and maintaining system stability. Regular kernel updates and security monitoring are essential to prevent exploitation of this vulnerability in production environments.