{ "dataType": "CVE_RECORD", "cveMetadata": { "cveId": "CVE-2024-26852", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.183Z", "datePublished": "2024-04-17T10:17:15.923Z", "dateUpdated": "2026-08-05T11:27:48.147Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:27:48.147Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/ipv6: avoid possible UAF in ip6_route_mpath_notify()\n\nsyzbot found another use-after-free in ip6_route_mpath_notify() [1]\n\nCommit f7225172f25a (\"net/ipv6: prevent use after free in\nip6_route_mpath_notify\") was not able to fix the root cause.\n\nWe need to defer the fib6_info_release() calls after\nip6_route_mpath_notify(), in the cleanup phase.\n\n[1]\nBUG: KASAN: slab-use-after-free in rt6_fill_node+0x1460/0x1ac0\nRead of size 4 at addr ffff88809a07fc64 by task syz-executor.2/23037\n\nCPU: 0 PID: 23037 Comm: syz-executor.2 Not tainted 6.8.0-rc4-syzkaller-01035-gea7f3cfaa588 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024\nCall Trace:\n \n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x167/0x540 mm/kasan/report.c:488\n kasan_report+0x142/0x180 mm/kasan/report.c:601\n rt6_fill_node+0x1460/0x1ac0\n inet6_rt_notify+0x13b/0x290 net/ipv6/route.c:6184\n ip6_route_mpath_notify net/ipv6/route.c:5198 [inline]\n ip6_route_multipath_add net/ipv6/route.c:5404 [inline]\n inet6_rtm_newroute+0x1d0f/0x2300 net/ipv6/route.c:5517\n rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597\n netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543\n netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367\n netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg+0x221/0x270 net/socket.c:745\n ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584\n ___sys_sendmsg net/socket.c:2638 [inline]\n __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667\n do_syscall_64+0xf9/0x240\n entry_SYSCALL_64_after_hwframe+0x6f/0x77\nRIP: 0033:0x7f73dd87dda9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f73de6550c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f73dd9ac050 RCX: 00007f73dd87dda9\nRDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000005\nRBP: 00007f73dd8ca47a R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000006e R14: 00007f73dd9ac050 R15: 00007ffdbdeb7858\n \n\nAllocated by task 23037:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n poison_kmalloc_redzone mm/kasan/common.c:372 [inline]\n __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:389\n kasan_kmalloc include/linux/kasan.h:211 [inline]\n __do_kmalloc_node mm/slub.c:3981 [inline]\n __kmalloc+0x22e/0x490 mm/slub.c:3994\n kmalloc include/linux/slab.h:594 [inline]\n kzalloc include/linux/slab.h:711 [inline]\n fib6_info_alloc+0x2e/0xf0 net/ipv6/ip6_fib.c:155\n ip6_route_info_create+0x445/0x12b0 net/ipv6/route.c:3758\n ip6_route_multipath_add net/ipv6/route.c:5298 [inline]\n inet6_rtm_newroute+0x744/0x2300 net/ipv6/route.c:5517\n rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597\n netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543\n netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367\n netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg+0x221/0x270 net/socket.c:745\n ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584\n ___sys_sendmsg net/socket.c:2638 [inline]\n __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667\n do_syscall_64+0xf9/0x240\n entry_SYSCALL_64_after_hwframe+0x6f/0x77\n\nFreed by task 16:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n kasan_save_free_info+0x4e/0x60 mm/kasan/generic.c:640\n poison_slab_object+0xa6/0xe0 m\n---truncated---" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is triggered by an RTM_NEWROUTE message sent over an AF_NETLINK/NETLINK_ROUTE socket via sendmsg(), which requires local access to the system. There is no remote packet-processing path into ip6_route_multipath_add().\nAC:L - The attacker creates both sides of the condition: they drop the last reference themselves and can widen the window arbitrarily by supplying many nexthops, by setting RTA_EXPIRES=0 so the non-rtnl gc softirq reaps the route, and by lowering net.ipv6.route.gc_interval inside their own netns, with unlimited retries. syzbot reproduced it, confirming reliable triggerability.\nPR:L - rtnetlink_rcv_msg() only requires netlink_net_capable(skb, CAP_NET_ADMIN), which is evaluated against the network namespace's user namespace, so any unprivileged local user obtains it with `unshare -Urn`. Multipath ECMP routes are addable in that namespace using RTNH_F_ONLINK gateways, which bypasses gateway reachability validation.\nUI:N - The entire sequence is performed by the attacker's own process in a single netlink transaction; no victim action, mount, or other interaction is needed.\nS:U - The use-after-free corrupts kernel heap memory and is exploited within the same kernel security authority; no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - rt6_fill_node() reads the freed kmalloc-512 fib6_info and copies its contents into an RTM_NEWROUTE netlink message returned to the attacker's socket, including dereferencing pointers taken from freed memory such as rt->fib6_metrics (passed to rtnetlink_put_metrics()), rt->fib6_table, and rt->fib6_nh. Reclaiming the freed slot with controlled data turns this into an arbitrary kernel-memory read leaked directly to userspace.\nI:H - This is a use-after-free on a 512-byte kmalloc object that an unprivileged attacker can spray and reclaim, after which the kernel dereferences attacker-controlled pointers and performs a list_for_each_entry_safe() walk over the freed fib6_siblings list head. That yields controlled pointer traversal and corruption suitable for privilege escalation.\nA:H - The KASAN slab-use-after-free in rt6_fill_node() causes an oops/panic when the freed object is unmapped, poisoned, or reclaimed with invalid pointers, and it can be triggered repeatedly to reliably crash the kernel." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv6/route.c" ], "versions": [ { "version": "3b1137fe74829e021f483756a648cbb87c8a1b4a", "lessThan": "31ea5bcc7d4cd1423de6be327a2c034725704136", "status": "affected", "versionType": "git" }, { "version": "3b1137fe74829e021f483756a648cbb87c8a1b4a", "lessThan": "664f9c647260cc9d68b4e31d9899530d89dd045e", "status": "affected", "versionType": "git" }, { "version": "3b1137fe74829e021f483756a648cbb87c8a1b4a", "lessThan": "79ce2e54cc0ae366f45516c00bf1b19aa43e9abe", "status": "affected", "versionType": "git" }, { "version": "3b1137fe74829e021f483756a648cbb87c8a1b4a", "lessThan": "cae3303257950d03ffec2df4a45e836f10d26c24", "status": "affected", "versionType": "git" }, { "version": "3b1137fe74829e021f483756a648cbb87c8a1b4a", "lessThan": "394334fe2ae3b9f1e2332b873857e84cb28aac18", "status": "affected", "versionType": "git" }, { "version": "3b1137fe74829e021f483756a648cbb87c8a1b4a", "lessThan": "ed883060c38721ed828061f6c0c30e5147326c9a", "status": "affected", "versionType": "git" }, { "version": "3b1137fe74829e021f483756a648cbb87c8a1b4a", "lessThan": "61b34f73cdbdb8eaf9ea12e9e2eb3b29716c4dda", "status": "affected", "versionType": "git" }, { "version": "3b1137fe74829e021f483756a648cbb87c8a1b4a", "lessThan": "685f7d531264599b3f167f1e94bbd22f120e5fab", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv6/route.c" ], "versions": [ { "version": "4.11", "status": "affected" }, { "version": "0", "lessThan": "4.11", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.310", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.272", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.213", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.152", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.82", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.22", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.7.10", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "4.19.310" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.4.272" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.10.213" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.15.152" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.1.82" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.6.22" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.7.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.8" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/31ea5bcc7d4cd1423de6be327a2c034725704136" }, { "url": "https://git.kernel.org/stable/c/664f9c647260cc9d68b4e31d9899530d89dd045e" }, { "url": "https://git.kernel.org/stable/c/79ce2e54cc0ae366f45516c00bf1b19aa43e9abe" }, { "url": "https://git.kernel.org/stable/c/cae3303257950d03ffec2df4a45e836f10d26c24" }, { "url": "https://git.kernel.org/stable/c/394334fe2ae3b9f1e2332b873857e84cb28aac18" }, { "url": "https://git.kernel.org/stable/c/ed883060c38721ed828061f6c0c30e5147326c9a" }, { "url": "https://git.kernel.org/stable/c/61b34f73cdbdb8eaf9ea12e9e2eb3b29716c4dda" }, { "url": "https://git.kernel.org/stable/c/685f7d531264599b3f167f1e94bbd22f120e5fab" } ], "title": "net/ipv6: avoid possible UAF in ip6_route_mpath_notify()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.699Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/31ea5bcc7d4cd1423de6be327a2c034725704136", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/664f9c647260cc9d68b4e31d9899530d89dd045e", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/79ce2e54cc0ae366f45516c00bf1b19aa43e9abe", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/cae3303257950d03ffec2df4a45e836f10d26c24", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/394334fe2ae3b9f1e2332b873857e84cb28aac18", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/ed883060c38721ed828061f6c0c30e5147326c9a", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/61b34f73cdbdb8eaf9ea12e9e2eb3b29716c4dda", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/685f7d531264599b3f167f1e94bbd22f120e5fab", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "tags": [ "x_transferred" ] } ] }, { "problemTypes": [ { "descriptions": [ { "type": "CWE", "cweId": "CWE-416", "lang": "en", "description": "CWE-416 Use After Free" } ] } ], "affected": [ { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "3b1137fe7482", "status": "affected", "lessThan": "31ea5bcc7d4c", "versionType": "custom" }, { "version": "3b1137fe7482", "status": "affected", "lessThan": "664f9c647260", "versionType": "custom" }, { "version": "3b1137fe7482", "status": "affected", "lessThan": "79ce2e54cc0a", "versionType": "custom" }, { "version": "3b1137fe7482", "status": "affected", "lessThan": "cae330325795", "versionType": "custom" }, { "version": "3b1137fe7482", "status": "affected", "lessThan": "394334fe2ae3", "versionType": "custom" }, { "version": "3b1137fe7482", "status": "affected", "lessThan": "ed883060c387", "versionType": "custom" }, { "version": "3b1137fe7482", "status": "affected", "lessThan": "61b34f73cdbd", "versionType": "custom" }, { "version": "3b1137fe7482", "status": "affected", "lessThan": "685f7d531264", "versionType": "custom" }, { "version": "4.11", "status": "affected" }, { "version": "0", "status": "unaffected", "lessThan": "4.11", "versionType": "custom" }, { "version": "4.19.310", "status": "unaffected", "lessThanOrEqual": "4.20", "versionType": "custom" }, { "version": "5.4.272", "status": "unaffected", "lessThanOrEqual": "5.5", "versionType": "custom" }, { "version": "5.10.213", "status": "unaffected", "lessThanOrEqual": "5.11", "versionType": "custom" }, { "version": "5.15.152", "status": "unaffected", "lessThanOrEqual": "5.16", "versionType": "custom" }, { "version": "6.1.82", "status": "unaffected", "lessThanOrEqual": "6.2", "versionType": "custom" }, { "version": "6.6.22", "status": "unaffected", "lessThanOrEqual": "6.7", "versionType": "custom" }, { "version": "6.7.10", "status": "unaffected", "lessThanOrEqual": "6.8", "versionType": "custom" }, { "version": "6.8", "status": "unaffected", "lessThanOrEqual": "*", "versionType": "custom" } ] } ], "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "timestamp": "2024-04-19T20:41:29.771297Z", "id": "CVE-2024-26852", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-11T21:48:49.822Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T11:49:33.817Z" }, "affected": [ { "vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [ { "status": "affected", "version": "0", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ] } ] }, "dataVersion": "5.2" }