{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-26856", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.183Z", "datePublished": "2024-04-17T10:17:18.475Z", "dateUpdated": "2026-08-05T11:27:50.303Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:27:50.303Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sparx5: Fix use after free inside sparx5_del_mact_entry\n\nBased on the static analyzis of the code it looks like when an entry\nfrom the MAC table was removed, the entry was still used after being\nfreed. More precise the vid of the mac_entry was used after calling\ndevm_kfree on the mac_entry.\nThe fix consists in first using the vid of the mac_entry to delete the\nentry from the HW and after that to free it." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The vulnerability is driven by Ethernet frames on the L2 segment — an unauthenticated attacker connected to a Sparx5 switch port populates the MAC table with chosen source MACs, and a MAC roam or FDB age-out makes the bridge emit SWITCHDEV_FDB_DEL_TO_DEVICE into sparx5_del_mact_entry(). No routing is involved, so this is same-broadcast-domain (Adjacent) rather than Network.\nAC:L - The free-then-use is unconditional straight-line code, not a race — every matching entry deletion frees mact_entry and then reads mact_entry->vid. The attacker controls both the MAC/VID that populates the table and the trigger (moving the same source MAC between ports forces br_fdb_update() to emit the delete notification synchronously), so it is reproducible on demand.\nPR:N - The frame-driven path requires no credentials or account on the switch whatsoever — MAC learning, roaming, and FDB aging are automatic. The privileged `bridge fdb del` route is only an alternative, strictly weaker trigger.\nUI:N - No victim action is needed; bridge MAC learning, roaming and aging happen automatically in response to attacker-sent frames on an already-configured bridged switch port.\nS:U - The freed object and the corrupted state are both kernel-resident within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - Freed slab memory is read back and acted upon, and the object lives in a general kmalloc cache that concurrent GFP_ATOMIC softirq allocations (including the driver's own attacker-driven switchdev work and skb allocations) can immediately reoccupy, letting an attacker influence and infer freed heap contents. Per use-after-free scoring, UAF primitives generalize to kernel memory disclosure.\nI:H - The stale value read from freed memory is written directly into the hardware MAC-table unlearn command, so the wrong VID is unlearned — the attacker's revoked MAC stays programmed and forwarded in hardware while an unrelated victim's entry can be purged, corrupting switch forwarding and isolation state. As a use-after-free it also carries the general potential for heap-grooming-based write primitives.\nA:H - Dereferencing freed slab memory can oops outright — the kfree() immediately preceding the read can discard the last-in-use slab page back to the page allocator — and KASAN/hardened kernels report or panic on it. The attacker can retrigger it continuously by flooding frames with rotating source MACs, and corrupted MAC-table state causes persistent forwarding breakage." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c" ], "versions": [ { "version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "lessThan": "e46274df1100fb0c06704195bfff5bfbd418bf64", "status": "affected", "versionType": "git" }, { "version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "lessThan": "0de693d68b0a18d5e256556c7c62d92cca35ad52", "status": "affected", "versionType": "git" }, { "version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "lessThan": "e83bebb718fd1f42549358730e1206164e0861d6", "status": "affected", "versionType": "git" }, { "version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "lessThan": "71809805b95052ff551922f11660008fb3666025", "status": "affected", "versionType": "git" }, { "version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "lessThan": "89d72d4125e94aa3c2140fedd97ce07ba9e37674", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c" ], "versions": [ { "version": "5.14", "status": "affected" }, { "version": "0", "lessThan": "5.14", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.152", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.82", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.22", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.7.10", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "5.15.152" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.1.82" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.6.22" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.7.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.8" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/e46274df1100fb0c06704195bfff5bfbd418bf64" }, { "url": "https://git.kernel.org/stable/c/0de693d68b0a18d5e256556c7c62d92cca35ad52" }, { "url": "https://git.kernel.org/stable/c/e83bebb718fd1f42549358730e1206164e0861d6" }, { "url": "https://git.kernel.org/stable/c/71809805b95052ff551922f11660008fb3666025" }, { "url": "https://git.kernel.org/stable/c/89d72d4125e94aa3c2140fedd97ce07ba9e37674" } ], "title": "net: sparx5: Fix use after free inside sparx5_del_mact_entry", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CISA ADP Vulnrichment", "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-26856", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-05-01T19:36:26.233327Z" } } } ], "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:49:15.853Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.666Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/e46274df1100fb0c06704195bfff5bfbd418bf64", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/0de693d68b0a18d5e256556c7c62d92cca35ad52", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/e83bebb718fd1f42549358730e1206164e0861d6", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/71809805b95052ff551922f11660008fb3666025", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/89d72d4125e94aa3c2140fedd97ce07ba9e37674", "tags": [ "x_transferred" ] } ] } ] } }