CVE-2024-26739

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26739
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mirred: don't override retval if we already lost the skb If we're redirecting the skb, and haven't called tcf_mirred_forward(), yet, we need to tell the core to drop the skb by setting the retcode to SHOT. If we have called tcf_mirred_forward(), however, the skb is out of our hands and returning SHOT will lead to UaF. Move the retval override to the error path which actually need it.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0117fe0a4615a7c8d30d6ebcbf87332fbe63e6fd
https://git.kernel.org/stable/c/166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 Patch
https://git.kernel.org/stable/c/28cdbbd38a4413b8eff53399b3f872fd4e80db9d Patch
https://git.kernel.org/stable/c/9d3ef89b6a5e9f2e940de2cef3d543be0be8dec5
https://git.kernel.org/stable/c/e873e8f7d03a2ee5b77fb1a305c782fed98e2754
https://git.kernel.org/stable/c/f4e294bbdca8ac8757db436fc82214f3882fc7e7 Patch
https://git.kernel.org/stable/c/166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 Patch
https://git.kernel.org/stable/c/28cdbbd38a4413b8eff53399b3f872fd4e80db9d Patch
https://git.kernel.org/stable/c/f4e294bbdca8ac8757db436fc82214f3882fc7e7 Patch
https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*
History

03 Nov 2025, 20:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html -

03 Nov 2025, 18:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html -

04 Jun 2025, 13:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/0117fe0a4615a7c8d30d6ebcbf87332fbe63e6fd -

09 May 2025, 08:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/9d3ef89b6a5e9f2e940de2cef3d543be0be8dec5 -

02 May 2025, 07:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/e873e8f7d03a2ee5b77fb1a305c782fed98e2754 -

07 Jan 2025, 17:28

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 - () https://git.kernel.org/stable/c/166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 - Patch
References () https://git.kernel.org/stable/c/28cdbbd38a4413b8eff53399b3f872fd4e80db9d - () https://git.kernel.org/stable/c/28cdbbd38a4413b8eff53399b3f872fd4e80db9d - Patch
References () https://git.kernel.org/stable/c/f4e294bbdca8ac8757db436fc82214f3882fc7e7 - () https://git.kernel.org/stable/c/f4e294bbdca8ac8757db436fc82214f3882fc7e7 - Patch
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-416

21 Nov 2024, 09:02

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/sched: act_mirred: no anula retval si ya perdimos el skb. Si estamos redirigiendo el skb y aún no hemos llamado a tcf_mirred_forward(), necesitamos para decirle al núcleo que suelte el skb configurando el código de retección en SHOT. Sin embargo, si hemos llamado a tcf_mirred_forward(), el skb está fuera de nuestras manos y devolver SHOT conducirá a UaF. Mueva la anulación de recuperación a la ruta de error que realmente la necesita.
References () https://git.kernel.org/stable/c/166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 - () https://git.kernel.org/stable/c/166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 -
References () https://git.kernel.org/stable/c/28cdbbd38a4413b8eff53399b3f872fd4e80db9d - () https://git.kernel.org/stable/c/28cdbbd38a4413b8eff53399b3f872fd4e80db9d -
References () https://git.kernel.org/stable/c/f4e294bbdca8ac8757db436fc82214f3882fc7e7 - () https://git.kernel.org/stable/c/f4e294bbdca8ac8757db436fc82214f3882fc7e7 -

03 Apr 2024, 17:24

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-03 17:15

Updated : 2025-11-03 20:16

NVD link : CVE-2024-26739

Mitre link : CVE-2024-26739

CVE.ORG link : CVE-2024-26739

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free