CVE-2024-26766 is a vulnerability in the Linux kernel's InfiniBand (IB) hfi1 driver, specifically related to the handling of SDMA (System Direct Memory Access) transmit descriptors in the ipoib (IP over InfiniBand) subsystem. The vulnerability arises from an off-by-one error introduced in commit fd8958efe877, which causes an overflow of the 'descs' array within the ipoib_txreq structure when an SDMA send operation involves exactly six descriptors and requires dword padding in a seventh descriptor. This improper handling leads to a buffer overflow into adjacent memory within the container structure, corrupting data and causing kernel panics or crashes during send completion. The issue is reproducible via the sendmsg system call, which triggers the transmission process. Kernel logs indicate a general protection fault due to an invalid pointer dereference, with call traces pointing to the hfi1_ipoib_send_dma_common and related functions. The root cause is the incorrect calculation of the descriptor array size in the _pad_sdma_tx_descs() function, which fails to properly expand the array when padding is needed. The fix involves correcting this expression to ensure the descriptor array is adequately sized, preventing overflow and stabilizing the system. This vulnerability affects multiple recent Linux kernel versions identified by specific commit hashes and is relevant to systems utilizing InfiniBand networking with the hfi1 driver. No known exploits are reported in the wild as of the publication date, and no CVSS score has been assigned yet.

For European organizations, especially those operating in high-performance computing (HPC), research institutions, data centers, and enterprises relying on InfiniBand networking for low-latency, high-throughput communication, this vulnerability poses a risk of system instability and denial of service (DoS). The kernel panic and crashes triggered by this flaw can disrupt critical applications, leading to downtime and potential data loss. While the vulnerability does not directly indicate privilege escalation or remote code execution, the resulting instability can impact availability and operational continuity. Organizations using Linux kernels with the affected hfi1 driver versions are at risk if they utilize the sendmsg system call in contexts involving SDMA transmissions with specific descriptor counts. Given the specialized nature of InfiniBand hardware, the impact is more pronounced in sectors with advanced networking infrastructure. European entities in scientific research, financial services, and telecommunications that deploy InfiniBand are particularly susceptible. Additionally, the instability could indirectly affect multi-tenant cloud environments or service providers hosting HPC workloads, potentially impacting European customers and services.

To mitigate this vulnerability, European organizations should: 1) Immediately identify Linux systems running affected kernel versions with the hfi1 InfiniBand driver enabled, focusing on those utilizing ipoib and SDMA features. 2) Apply the official Linux kernel patches that correct the _pad_sdma_tx_descs() function to properly size the descriptor array, ensuring the fix is backported to stable kernel releases if necessary. 3) Where patching is delayed, consider temporarily disabling InfiniBand ipoib networking or restricting the use of sendmsg calls that trigger SDMA transmissions with six descriptors and padding, if feasible. 4) Monitor kernel logs for signs of general protection faults or crashes related to hfi1_ipoib functions to detect exploitation attempts or instability. 5) Implement rigorous testing of kernel updates in staging environments to validate stability before production deployment. 6) Engage with hardware vendors and Linux distribution maintainers to receive timely updates and advisories. 7) Educate system administrators about the specific conditions triggering the vulnerability to avoid inadvertent triggering during routine operations. These steps go beyond generic advice by focusing on the specific driver, function, and usage patterns involved in the vulnerability.