{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-26953", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.200Z", "datePublished": "2024-05-01T05:18:43.199Z", "dateUpdated": "2026-08-05T11:28:34.241Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:28:34.241Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: esp: fix bad handling of pages from page_pool\n\nWhen the skb is reorganized during esp_output (!esp->inline), the pages\ncoming from the original skb fragments are supposed to be released back\nto the system through put_page. But if the skb fragment pages are\noriginating from a page_pool, calling put_page on them will trigger a\npage_pool leak which will eventually result in a crash.\n\nThis leak can be easily observed when using CONFIG_DEBUG_VM and doing\nipsec + gre (non offloaded) forwarding:\n\n BUG: Bad page state in process ksoftirqd/16 pfn:1451b6\n page:00000000de2b8d32 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1451b6000 pfn:0x1451b6\n flags: 0x200000000000000(node=0|zone=2)\n page_type: 0xffffffff()\n raw: 0200000000000000 dead000000000040 ffff88810d23c000 0000000000000000\n raw: 00000001451b6000 0000000000000001 00000000ffffffff 0000000000000000\n page dumped because: page_pool leak\n Modules linked in: ip_gre gre mlx5_ib mlx5_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core overlay zram zsmalloc fuse [last unloaded: mlx5_core]\n CPU: 16 PID: 96 Comm: ksoftirqd/16 Not tainted 6.8.0-rc4+ #22\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n Call Trace:\n \n dump_stack_lvl+0x36/0x50\n bad_page+0x70/0xf0\n free_unref_page_prepare+0x27a/0x460\n free_unref_page+0x38/0x120\n esp_ssg_unref.isra.0+0x15f/0x200\n esp_output_tail+0x66d/0x780\n esp_xmit+0x2c5/0x360\n validate_xmit_xfrm+0x313/0x370\n ? validate_xmit_skb+0x1d/0x330\n validate_xmit_skb_list+0x4c/0x70\n sch_direct_xmit+0x23e/0x350\n __dev_queue_xmit+0x337/0xba0\n ? nf_hook_slow+0x3f/0xd0\n ip_finish_output2+0x25e/0x580\n iptunnel_xmit+0x19b/0x240\n ip_tunnel_xmit+0x5fb/0xb60\n ipgre_xmit+0x14d/0x280 [ip_gre]\n dev_hard_start_xmit+0xc3/0x1c0\n __dev_queue_xmit+0x208/0xba0\n ? nf_hook_slow+0x3f/0xd0\n ip_finish_output2+0x1ca/0x580\n ip_sublist_rcv_finish+0x32/0x40\n ip_sublist_rcv+0x1b2/0x1f0\n ? ip_rcv_finish_core.constprop.0+0x460/0x460\n ip_list_rcv+0x103/0x130\n __netif_receive_skb_list_core+0x181/0x1e0\n netif_receive_skb_list_internal+0x1b3/0x2c0\n napi_gro_receive+0xc8/0x200\n gro_cell_poll+0x52/0x90\n __napi_poll+0x25/0x1a0\n net_rx_action+0x28e/0x300\n __do_softirq+0xc3/0x276\n ? sort_range+0x20/0x20\n run_ksoftirqd+0x1e/0x30\n smpboot_thread_fn+0xa6/0x130\n kthread+0xcd/0x100\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x31/0x50\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork_asm+0x11/0x20\n \n\nThe suggested fix is to introduce a new wrapper (skb_page_unref) that\ncovers page refcounting for page_pool pages as well." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable path is reached purely by received network packets — a page_pool-backed NIC RX skb forwarded into an IPsec ESP SA (`ip_list_rcv → ipgre_xmit → esp_xmit → esp_output_tail → esp_ssg_unref`), exactly as in the reported repro. No local access or syscall is involved.\nAC:L - The attacker simply sends traffic through an IPsec gateway; packet size and fragment layout (which drive the non-inplace ESP reorganization path) are attacker-controlled and the trigger repeats on every matching packet. There is no race to win and no memory-layout precondition outside the attacker's influence.\nPR:N - No authentication or credentials of any kind are needed — any unauthenticated remote host whose packets are routed into the ESP transform on the forwarding gateway reaches the bug. The vulnerable code runs in softirq on the transmit path with no privilege gate.\nUI:N - Triggering requires only that the attacker's packets be forwarded through the IPsec/GRE path; no action by any local user or administrator is needed beyond the pre-existing VPN configuration.\nS:U - The premature page free and the resulting corruption are both contained within the kernel's own security authority, with no crossing into a hypervisor or other authority.\nC:H - The page is returned to the buddy allocator while page_pool still owns it and it remains DMA-mapped, so it can be reallocated to arbitrary kernel users while still reachable as an RX buffer — a page use-after-free permitting cross-allocation disclosure of kernel memory into network-visible buffers.\nI:H - The same premature free gives a write primitive: the NIC can DMA attacker-controlled packet payload into pages that have been reallocated to other kernel objects, and the residual pp_ref_count/pool tracking leads to refcount underflow and double free — memory corruption exploitable for control-flow hijacking.\nA:H - The commit explicitly states the page_pool leak \"will eventually result in a crash\", with a confirmed `BUG: Bad page state` splat in softirq context; a remote attacker can drive this repeatedly to panic an IPsec gateway." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/linux/skbuff.h", "net/ipv4/esp4.c", "net/ipv6/esp6.c" ], "versions": [ { "version": "6a5bcd84e886a9a91982e515c539529c28acdcc2", "lessThan": "8291b4eac429c480386669444c6377573f5d8664", "status": "affected", "versionType": "git" }, { "version": "6a5bcd84e886a9a91982e515c539529c28acdcc2", "lessThan": "1abb20a5f4b02fb3020f88456fc1e6069b3cdc45", "status": "affected", "versionType": "git" }, { "version": "6a5bcd84e886a9a91982e515c539529c28acdcc2", "lessThan": "f278ff9db67264715d0d50e3e75044f8b78990f4", "status": "affected", "versionType": "git" }, { "version": "6a5bcd84e886a9a91982e515c539529c28acdcc2", "lessThan": "c3198822c6cb9fb588e446540485669cc81c5d34", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/linux/skbuff.h", "net/ipv4/esp4.c", "net/ipv6/esp6.c" ], "versions": [ { "version": "5.14", "status": "affected" }, { "version": "0", "lessThan": "5.14", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.24", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.7.12", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.3", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.6.24" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.7.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.8.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.9" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/8291b4eac429c480386669444c6377573f5d8664" }, { "url": "https://git.kernel.org/stable/c/1abb20a5f4b02fb3020f88456fc1e6069b3cdc45" }, { "url": "https://git.kernel.org/stable/c/f278ff9db67264715d0d50e3e75044f8b78990f4" }, { "url": "https://git.kernel.org/stable/c/c3198822c6cb9fb588e446540485669cc81c5d34" } ], "title": "net: esp: fix bad handling of pages from page_pool", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.778Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/8291b4eac429c480386669444c6377573f5d8664", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/1abb20a5f4b02fb3020f88456fc1e6069b3cdc45", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/f278ff9db67264715d0d50e3e75044f8b78990f4", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/c3198822c6cb9fb588e446540485669cc81c5d34", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-26953", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T15:45:33.246768Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:48.971Z" } } ] } }