cve 2024 26789

CVE-2024-26789 is a Linux kernel vulnerability affecting the ARM64 NEON AES implementation. The bug involves a bounds-checking error in the crypto path that can lead to out-of-bounds memory accesses when processing short AES-CTR inputs. The fix involves cloning a workaround that temporarily buffers sub-16-byte tails into the bit-sliced fallback path. This flaw poses a kernel-level availability and integrity risk, and system administrators should apply distribution-specific kernel updates promptly. The vulnerability is tracked in the National Vulnerability Database (NVD) and has been patched upstream.