CVE-2024-26945: Linux Kernel Crypto IAA DoS Vulnerability

CVE-2024-26945 Overview

CVE-2024-26945 is a divide-by-zero flaw in the Linux kernel's Intel Analytics Accelerator (IAA) crypto driver. The issue exists in the rebalance_wq_table() function, where the calculated cpus_per_iaa value becomes zero when the number of CPUs is less than the number of IAA devices. Triggering this code path causes a kernel-level divide-by-zero fault, resulting in system instability or crash. The vulnerability is tracked under [CWE-369: Divide By Zero] and affects Linux kernel 6.9-rc1.

Critical Impact
Local attackers or misconfigured systems can trigger a kernel divide-by-zero in the crypto/iaa subsystem, leading to denial of service and potential integrity impact on affected hosts.

Affected Products

Linux Kernel (mainline development builds)
Linux Kernel 6.9-rc1
Systems using the Intel Analytics Accelerator (IAA) crypto driver

Discovery Timeline

2024-05-01 - CVE-2024-26945 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-26945

Vulnerability Analysis

The flaw resides in the Intel IAA crypto driver's work queue rebalancing logic. When the driver initializes, it distributes CPUs across available IAA devices by computing cpus_per_iaa = nr_cpus / nr_iaa. If nr_cpus is smaller than nr_iaa, integer division yields zero. The rebalance_wq_table() function later uses this value as a divisor, producing a runtime divide-by-zero exception in kernel context.

Because the fault occurs inside kernel code, the CPU raises a divide-error exception that the kernel handles as an oops. This impacts availability and can corrupt in-flight cryptographic work queue state. The condition also applies defensively to the nr_iaa == 0 case, which the upstream fix hardens even though that branch does not consume cpus_per_iaa.

Root Cause

The root cause is missing input validation on the ratio between available CPUs and enumerated IAA devices. The driver assumed nr_cpus >= nr_iaa and did not clamp cpus_per_iaa to a minimum value of one before using it as a divisor.

Attack Vector

Exploitation requires local access to a system running an affected kernel with the IAA crypto driver enabled. Any workload that causes the driver to invoke rebalance_wq_table() under an asymmetric CPU-to-IAA ratio triggers the fault. No user interaction or elevated privileges are required to reach the vulnerable path.

No public proof-of-concept exploit or CISA KEV listing exists for this issue. The vulnerability is described in prose because no verified exploit code is available. See the Kernel Git Commit 5a7e89d and Kernel Git Commit a5ca1be for the upstream fix.

Detection Methods for CVE-2024-26945

Indicators of Compromise

Kernel oops or panic messages referencing rebalance_wq_table or the iaa_crypto module in dmesg and /var/log/kern.log.
Divide-error traps (divide error: 0000) originating from the crypto subsystem call stack.
Unexpected reboots or hangs on hosts equipped with Intel IAA accelerators shortly after crypto workload initialization.

Detection Strategies

Inventory Linux hosts running kernel 6.9-rc1 or unpatched development builds with CONFIG_CRYPTO_DEV_IAA_CRYPTO enabled.
Compare the number of online CPUs against enumerated IAA devices using lscpu and accel-config list to identify at-risk topology.
Correlate kernel crash telemetry with IAA driver load events to surface anomalous panics tied to this code path.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on divide-error signatures inside crypto modules.
Track kernel version drift across the fleet to identify hosts running affected release candidate builds.
Monitor host uptime and unplanned reboot counters on systems with IAA hardware to detect recurring faults.

How to Mitigate CVE-2024-26945

Immediate Actions Required

Upgrade to a Linux kernel build that includes upstream commits 5a7e89d3315d and a5ca1be7f981.
Where patching is not immediate, unload or blacklist the iaa_crypto module on affected hosts.
Restrict local access to systems running vulnerable kernels until remediation completes.

Patch Information

The upstream fix ensures cpus_per_iaa is set to 1 when nr_cpus < nr_iaa and when nr_iaa == 0, eliminating the divide-by-zero. Apply the patches referenced in Kernel Git Commit 5a7e89d and Kernel Git Commit a5ca1be, or move to a stable kernel that has backported them.

Workarounds

Blacklist the iaa_crypto kernel module by adding blacklist iaa_crypto to /etc/modprobe.d/blacklist-iaa.conf and rebuilding the initramfs.
Disable IAA devices in BIOS or platform firmware on systems that do not require accelerated crypto offload.
Pin production hosts to stable kernel releases rather than 6.9-rc series builds until fixes propagate.

bash

# Configuration example: blacklist the vulnerable IAA crypto driver
echo "blacklist iaa_crypto" | sudo tee /etc/modprobe.d/blacklist-iaa.conf
sudo update-initramfs -u
sudo reboot

# Verify the module is not loaded after reboot
lsmod | grep iaa_crypto || echo "iaa_crypto not loaded"