CVE-2024-26626 (GCVE-0-2024-26626)
Vulnerability from cvelistv5
Published
2024-03-06 06:45
Modified
2026-08-05 11:26
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ipmr: fix kernel panic when forwarding mcast packets The stacktrace was: [ 86.305548] BUG: kernel NULL pointer dereference, address: 0000000000000092 [ 86.306815] #PF: supervisor read access in kernel mode [ 86.307717] #PF: error_code(0x0000) - not-present page [ 86.308624] PGD 0 P4D 0 [ 86.309091] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 86.309883] CPU: 2 PID: 3139 Comm: pimd Tainted: G U 6.8.0-6wind-knet #1 [ 86.311027] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.1-0-g0551a4be2c-prebuilt.qemu-project.org 04/01/2014 [ 86.312728] RIP: 0010:ip_mr_forward (/build/work/knet/net/ipv4/ipmr.c:1985) [ 86.313399] Code: f9 1f 0f 87 85 03 00 00 48 8d 04 5b 48 8d 04 83 49 8d 44 c5 00 48 8b 40 70 48 39 c2 0f 84 d9 00 00 00 49 8b 46 58 48 83 e0 fe <80> b8 92 00 00 00 00 0f 84 55 ff ff ff 49 83 47 38 01 45 85 e4 0f [ 86.316565] RSP: 0018:ffffad21c0583ae0 EFLAGS: 00010246 [ 86.317497] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 86.318596] RDX: ffff9559cb46c000 RSI: 0000000000000000 RDI: 0000000000000000 [ 86.319627] RBP: ffffad21c0583b30 R08: 0000000000000000 R09: 0000000000000000 [ 86.320650] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 [ 86.321672] R13: ffff9559c093a000 R14: ffff9559cc00b800 R15: ffff9559c09c1d80 [ 86.322873] FS: 00007f85db661980(0000) GS:ffff955a79d00000(0000) knlGS:0000000000000000 [ 86.324291] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 86.325314] CR2: 0000000000000092 CR3: 000000002f13a000 CR4: 0000000000350ef0 [ 86.326589] Call Trace: [ 86.327036] <TASK> [ 86.327434] ? show_regs (/build/work/knet/arch/x86/kernel/dumpstack.c:479) [ 86.328049] ? __die (/build/work/knet/arch/x86/kernel/dumpstack.c:421 /build/work/knet/arch/x86/kernel/dumpstack.c:434) [ 86.328508] ? page_fault_oops (/build/work/knet/arch/x86/mm/fault.c:707) [ 86.329107] ? do_user_addr_fault (/build/work/knet/arch/x86/mm/fault.c:1264) [ 86.329756] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223) [ 86.330350] ? __irq_work_queue_local (/build/work/knet/kernel/irq_work.c:111 (discriminator 1)) [ 86.331013] ? exc_page_fault (/build/work/knet/./arch/x86/include/asm/paravirt.h:693 /build/work/knet/arch/x86/mm/fault.c:1515 /build/work/knet/arch/x86/mm/fault.c:1563) [ 86.331702] ? asm_exc_page_fault (/build/work/knet/./arch/x86/include/asm/idtentry.h:570) [ 86.332468] ? ip_mr_forward (/build/work/knet/net/ipv4/ipmr.c:1985) [ 86.333183] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223) [ 86.333920] ipmr_mfc_add (/build/work/knet/./include/linux/rcupdate.h:782 /build/work/knet/net/ipv4/ipmr.c:1009 /build/work/knet/net/ipv4/ipmr.c:1273) [ 86.334583] ? __pfx_ipmr_hash_cmp (/build/work/knet/net/ipv4/ipmr.c:363) [ 86.335357] ip_mroute_setsockopt (/build/work/knet/net/ipv4/ipmr.c:1470) [ 86.336135] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223) [ 86.336854] ? ip_mroute_setsockopt (/build/work/knet/net/ipv4/ipmr.c:1470) [ 86.337679] do_ip_setsockopt (/build/work/knet/net/ipv4/ip_sockglue.c:944) [ 86.338408] ? __pfx_unix_stream_read_actor (/build/work/knet/net/unix/af_unix.c:2862) [ 86.339232] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223) [ 86.339809] ? aa_sk_perm (/build/work/knet/security/apparmor/include/cred.h:153 /build/work/knet/security/apparmor/net.c:181) [ 86.340342] ip_setsockopt (/build/work/knet/net/ipv4/ip_sockglue.c:1415) [ 86.340859] raw_setsockopt (/build/work/knet/net/ipv4/raw.c:836) [ 86.341408] ? security_socket_setsockopt (/build/work/knet/security/security.c:4561 (discriminator 13)) [ 86.342116] sock_common_setsockopt (/build/work/knet/net/core/sock.c:3716) [ 86.342747] do_sock_setsockopt (/build/work/knet/net/socket.c:2313) [ 86.343363] __sys_setsockopt (/build/work/knet/./include/linux/file.h:32 /build/work/kn ---truncated---
References
Impacted products
Vendor Product Version
Linux Linux Version: f69365e3a7cab819099249c50b39f4450fdddc60
Version: 7b32e63f881432bf30f282328b8e64c6aa494ba2
Version: 7d97858e21fbc472acda7d908357c5fe54a8e439
Version: bb7403655b3c3eb245d0ee330047cd3e20b3c4af
 Create a notification for this product.
   Linux Linux Version: 6.1.75   ≤
Version: 6.6.14   ≤
Version: 6.7.2   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:07:19.745Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d2f1b7fe74afd66298dbb3c7b39e7b62e4df1724"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dcaafdba6c6162bb49f1192850bc3bbc3707738c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2e8c9ae40adda2be1ba41c05fd3cd1e61cce3207"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e622502c310f1069fd9f41cd38210553115f610a"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26626",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:55:51.122168Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:30.184Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip.h",
            "net/ipv4/ip_sockglue.c",
            "net/ipv4/ipmr.c",
            "net/ipv4/raw.c",
            "net/ipv4/udp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d2f1b7fe74afd66298dbb3c7b39e7b62e4df1724",
              "status": "affected",
              "version": "f69365e3a7cab819099249c50b39f4450fdddc60",
              "versionType": "git"
            },
            {
              "lessThan": "dcaafdba6c6162bb49f1192850bc3bbc3707738c",
              "status": "affected",
              "version": "7b32e63f881432bf30f282328b8e64c6aa494ba2",
              "versionType": "git"
            },
            {
              "lessThan": "2e8c9ae40adda2be1ba41c05fd3cd1e61cce3207",
              "status": "affected",
              "version": "7d97858e21fbc472acda7d908357c5fe54a8e439",
              "versionType": "git"
            },
            {
              "lessThan": "e622502c310f1069fd9f41cd38210553115f610a",
              "status": "affected",
              "version": "bb7403655b3c3eb245d0ee330047cd3e20b3c4af",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip.h",
            "net/ipv4/ip_sockglue.c",
            "net/ipv4/ipmr.c",
            "net/ipv4/raw.c",
            "net/ipv4/udp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.1.77",
              "status": "affected",
              "version": "6.1.75",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.16",
              "status": "affected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7.4",
              "status": "affected",
              "version": "6.7.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.77",
                  "versionStartIncluding": "6.1.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.16",
                  "versionStartIncluding": "6.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.4",
                  "versionStartIncluding": "6.7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmr: fix kernel panic when forwarding mcast packets\n\nThe stacktrace was:\n[   86.305548] BUG: kernel NULL pointer dereference, address: 0000000000000092\n[   86.306815] #PF: supervisor read access in kernel mode\n[   86.307717] #PF: error_code(0x0000) - not-present page\n[   86.308624] PGD 0 P4D 0\n[   86.309091] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[   86.309883] CPU: 2 PID: 3139 Comm: pimd Tainted: G     U             6.8.0-6wind-knet #1\n[   86.311027] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.1-0-g0551a4be2c-prebuilt.qemu-project.org 04/01/2014\n[   86.312728] RIP: 0010:ip_mr_forward (/build/work/knet/net/ipv4/ipmr.c:1985)\n[ 86.313399] Code: f9 1f 0f 87 85 03 00 00 48 8d 04 5b 48 8d 04 83 49 8d 44 c5 00 48 8b 40 70 48 39 c2 0f 84 d9 00 00 00 49 8b 46 58 48 83 e0 fe \u003c80\u003e b8 92 00 00 00 00 0f 84 55 ff ff ff 49 83 47 38 01 45 85 e4 0f\n[   86.316565] RSP: 0018:ffffad21c0583ae0 EFLAGS: 00010246\n[   86.317497] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n[   86.318596] RDX: ffff9559cb46c000 RSI: 0000000000000000 RDI: 0000000000000000\n[   86.319627] RBP: ffffad21c0583b30 R08: 0000000000000000 R09: 0000000000000000\n[   86.320650] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001\n[   86.321672] R13: ffff9559c093a000 R14: ffff9559cc00b800 R15: ffff9559c09c1d80\n[   86.322873] FS:  00007f85db661980(0000) GS:ffff955a79d00000(0000) knlGS:0000000000000000\n[   86.324291] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   86.325314] CR2: 0000000000000092 CR3: 000000002f13a000 CR4: 0000000000350ef0\n[   86.326589] Call Trace:\n[   86.327036]  \u003cTASK\u003e\n[   86.327434] ? show_regs (/build/work/knet/arch/x86/kernel/dumpstack.c:479)\n[   86.328049] ? __die (/build/work/knet/arch/x86/kernel/dumpstack.c:421 /build/work/knet/arch/x86/kernel/dumpstack.c:434)\n[   86.328508] ? page_fault_oops (/build/work/knet/arch/x86/mm/fault.c:707)\n[   86.329107] ? do_user_addr_fault (/build/work/knet/arch/x86/mm/fault.c:1264)\n[   86.329756] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223)\n[   86.330350] ? __irq_work_queue_local (/build/work/knet/kernel/irq_work.c:111 (discriminator 1))\n[   86.331013] ? exc_page_fault (/build/work/knet/./arch/x86/include/asm/paravirt.h:693 /build/work/knet/arch/x86/mm/fault.c:1515 /build/work/knet/arch/x86/mm/fault.c:1563)\n[   86.331702] ? asm_exc_page_fault (/build/work/knet/./arch/x86/include/asm/idtentry.h:570)\n[   86.332468] ? ip_mr_forward (/build/work/knet/net/ipv4/ipmr.c:1985)\n[   86.333183] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223)\n[   86.333920] ipmr_mfc_add (/build/work/knet/./include/linux/rcupdate.h:782 /build/work/knet/net/ipv4/ipmr.c:1009 /build/work/knet/net/ipv4/ipmr.c:1273)\n[   86.334583] ? __pfx_ipmr_hash_cmp (/build/work/knet/net/ipv4/ipmr.c:363)\n[   86.335357] ip_mroute_setsockopt (/build/work/knet/net/ipv4/ipmr.c:1470)\n[   86.336135] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223)\n[   86.336854] ? ip_mroute_setsockopt (/build/work/knet/net/ipv4/ipmr.c:1470)\n[   86.337679] do_ip_setsockopt (/build/work/knet/net/ipv4/ip_sockglue.c:944)\n[   86.338408] ? __pfx_unix_stream_read_actor (/build/work/knet/net/unix/af_unix.c:2862)\n[   86.339232] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223)\n[   86.339809] ? aa_sk_perm (/build/work/knet/security/apparmor/include/cred.h:153 /build/work/knet/security/apparmor/net.c:181)\n[   86.340342] ip_setsockopt (/build/work/knet/net/ipv4/ip_sockglue.c:1415)\n[   86.340859] raw_setsockopt (/build/work/knet/net/ipv4/raw.c:836)\n[   86.341408] ? security_socket_setsockopt (/build/work/knet/security/security.c:4561 (discriminator 13))\n[   86.342116] sock_common_setsockopt (/build/work/knet/net/core/sock.c:3716)\n[   86.342747] do_sock_setsockopt (/build/work/knet/net/socket.c:2313)\n[   86.343363] __sys_setsockopt (/build/work/knet/./include/linux/file.h:32 /build/work/kn\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable state is created by a multicast IP packet received from the network \u2014 `ip_mr_input()` \u2192 `ipmr_cache_unresolved()` \u2192 `ipmr_cache_report()` strips the dst from the received skb before queuing it. Multicast traffic reaches a multicast router from arbitrary distances via PIM/MSDP and routed multicast, so the attacker need not be on the same L2 segment.\nAC:L - `skb_dst_drop()` in `ipv4_pktinfo_prepare()` is unconditional, so every packet queued for cache resolution deterministically loses its dst and the next MFC install oopses; there is no race, no memory-layout dependency, and no socket-option precondition. The multicast routing daemon installing the route in response to the IGMPMSG_NOCACHE upcall is the router\u0027s normal, automatic behavior.\nPR:N - A remote attacker only has to emit an unauthenticated multicast datagram for an (S,G) with no existing MFC entry; no credentials or session are needed. Even the purely local trigger requires only namespaced CAP_NET_ADMIN/CAP_NET_RAW obtainable by any unprivileged user via `unshare -Urn`, since `ip_mroute_setsockopt()` uses `ns_capable(net-\u003euser_ns, CAP_NET_ADMIN)`.\nUI:N - The multicast routing daemon adds the MFC entry automatically as part of its normal packet-driven operation, with no human involvement. No victim action such as mounting a filesystem or opening a file is required.\nS:U - The NULL dereference and the resulting oops occur inside the kernel that owns the affected multicast routing state, with no crossing into another security authority. There is no hypervisor, IOMMU, or sandbox boundary involved.\nC:N - The fault is a read of `rt-\u003ert_is_input` at the fixed unmapped address NULL+0x92 in `rt_is_output_route()`, which faults before any value is produced. No kernel memory contents are returned to or observable by the attacker.\nI:N - The bug is a read-only dereference of a NULL `skb_dst()`; no memory is written and no attacker-controlled pointer or length is involved. There is no corruption primitive to leverage for control-flow hijacking.\nA:H - The dereference produces a kernel oops/panic in `ip_mr_forward()`, and it happens with `rtnl_lock()` held and under `rcu_read_lock()`, so even absent `panic_on_oops` the dying task leaks RTNL and permanently deadlocks all subsequent network configuration. This is a complete, repeatable denial of service on a multicast router."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:26:22.586Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d2f1b7fe74afd66298dbb3c7b39e7b62e4df1724"
        },
        {
          "url": "https://git.kernel.org/stable/c/dcaafdba6c6162bb49f1192850bc3bbc3707738c"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e8c9ae40adda2be1ba41c05fd3cd1e61cce3207"
        },
        {
          "url": "https://git.kernel.org/stable/c/e622502c310f1069fd9f41cd38210553115f610a"
        }
      ],
      "title": "ipmr: fix kernel panic when forwarding mcast packets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26626",
    "datePublished": "2024-03-06T06:45:33.826Z",
    "dateReserved": "2024-02-19T14:20:24.135Z",
    "dateUpdated": "2026-08-05T11:26:22.586Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d2f1b7fe74afd66298dbb3c7b39e7b62e4df1724\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/dcaafdba6c6162bb49f1192850bc3bbc3707738c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2e8c9ae40adda2be1ba41c05fd3cd1e61cce3207\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e622502c310f1069fd9f41cd38210553115f610a\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:07:19.745Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26626\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:55:51.122168Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:17.022Z\"}}], \"cna\": {\"title\": \"ipmr: fix kernel panic when forwarding mcast packets\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The vulnerable state is created by a multicast IP packet received from the network \\u2014 `ip_mr_input()` \\u2192 `ipmr_cache_unresolved()` \\u2192 `ipmr_cache_report()` strips the dst from the received skb before queuing it. Multicast traffic reaches a multicast router from arbitrary distances via PIM/MSDP and routed multicast, so the attacker need not be on the same L2 segment.\\nAC:L - `skb_dst_drop()` in `ipv4_pktinfo_prepare()` is unconditional, so every packet queued for cache resolution deterministically loses its dst and the next MFC install oopses; there is no race, no memory-layout dependency, and no socket-option precondition. The multicast routing daemon installing the route in response to the IGMPMSG_NOCACHE upcall is the router\u0027s normal, automatic behavior.\\nPR:N - A remote attacker only has to emit an unauthenticated multicast datagram for an (S,G) with no existing MFC entry; no credentials or session are needed. Even the purely local trigger requires only namespaced CAP_NET_ADMIN/CAP_NET_RAW obtainable by any unprivileged user via `unshare -Urn`, since `ip_mroute_setsockopt()` uses `ns_capable(net-\u003euser_ns, CAP_NET_ADMIN)`.\\nUI:N - The multicast routing daemon adds the MFC entry automatically as part of its normal packet-driven operation, with no human involvement. No victim action such as mounting a filesystem or opening a file is required.\\nS:U - The NULL dereference and the resulting oops occur inside the kernel that owns the affected multicast routing state, with no crossing into another security authority. There is no hypervisor, IOMMU, or sandbox boundary involved.\\nC:N - The fault is a read of `rt-\u003ert_is_input` at the fixed unmapped address NULL+0x92 in `rt_is_output_route()`, which faults before any value is produced. No kernel memory contents are returned to or observable by the attacker.\\nI:N - The bug is a read-only dereference of a NULL `skb_dst()`; no memory is written and no attacker-controlled pointer or length is involved. There is no corruption primitive to leverage for control-flow hijacking.\\nA:H - The dereference produces a kernel oops/panic in `ip_mr_forward()`, and it happens with `rtnl_lock()` held and under `rcu_read_lock()`, so even absent `panic_on_oops` the dying task leaks RTNL and permanently deadlocks all subsequent network configuration. This is a complete, repeatable denial of service on a multicast router.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f69365e3a7cab819099249c50b39f4450fdddc60\", \"lessThan\": \"d2f1b7fe74afd66298dbb3c7b39e7b62e4df1724\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7b32e63f881432bf30f282328b8e64c6aa494ba2\", \"lessThan\": \"dcaafdba6c6162bb49f1192850bc3bbc3707738c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7d97858e21fbc472acda7d908357c5fe54a8e439\", \"lessThan\": \"2e8c9ae40adda2be1ba41c05fd3cd1e61cce3207\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bb7403655b3c3eb245d0ee330047cd3e20b3c4af\", \"lessThan\": \"e622502c310f1069fd9f41cd38210553115f610a\", \"versionType\": \"git\"}], \"programFiles\": [\"include/net/ip.h\", \"net/ipv4/ip_sockglue.c\", \"net/ipv4/ipmr.c\", \"net/ipv4/raw.c\", \"net/ipv4/udp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.1.75\", \"lessThan\": \"6.1.77\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.6.14\", \"lessThan\": \"6.6.16\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.7.2\", \"lessThan\": \"6.7.4\", \"versionType\": \"semver\"}], \"programFiles\": [\"include/net/ip.h\", \"net/ipv4/ip_sockglue.c\", \"net/ipv4/ipmr.c\", \"net/ipv4/raw.c\", \"net/ipv4/udp.c\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d2f1b7fe74afd66298dbb3c7b39e7b62e4df1724\"}, {\"url\": \"https://git.kernel.org/stable/c/dcaafdba6c6162bb49f1192850bc3bbc3707738c\"}, {\"url\": \"https://git.kernel.org/stable/c/2e8c9ae40adda2be1ba41c05fd3cd1e61cce3207\"}, {\"url\": \"https://git.kernel.org/stable/c/e622502c310f1069fd9f41cd38210553115f610a\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nipmr: fix kernel panic when forwarding mcast packets\\n\\nThe stacktrace was:\\n[   86.305548] BUG: kernel NULL pointer dereference, address: 0000000000000092\\n[   86.306815] #PF: supervisor read access in kernel mode\\n[   86.307717] #PF: error_code(0x0000) - not-present page\\n[   86.308624] PGD 0 P4D 0\\n[   86.309091] Oops: 0000 [#1] PREEMPT SMP NOPTI\\n[   86.309883] CPU: 2 PID: 3139 Comm: pimd Tainted: G     U             6.8.0-6wind-knet #1\\n[   86.311027] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.1-0-g0551a4be2c-prebuilt.qemu-project.org 04/01/2014\\n[   86.312728] RIP: 0010:ip_mr_forward (/build/work/knet/net/ipv4/ipmr.c:1985)\\n[ 86.313399] Code: f9 1f 0f 87 85 03 00 00 48 8d 04 5b 48 8d 04 83 49 8d 44 c5 00 48 8b 40 70 48 39 c2 0f 84 d9 00 00 00 49 8b 46 58 48 83 e0 fe \u003c80\u003e b8 92 00 00 00 00 0f 84 55 ff ff ff 49 83 47 38 01 45 85 e4 0f\\n[   86.316565] RSP: 0018:ffffad21c0583ae0 EFLAGS: 00010246\\n[   86.317497] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\\n[   86.318596] RDX: ffff9559cb46c000 RSI: 0000000000000000 RDI: 0000000000000000\\n[   86.319627] RBP: ffffad21c0583b30 R08: 0000000000000000 R09: 0000000000000000\\n[   86.320650] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001\\n[   86.321672] R13: ffff9559c093a000 R14: ffff9559cc00b800 R15: ffff9559c09c1d80\\n[   86.322873] FS:  00007f85db661980(0000) GS:ffff955a79d00000(0000) knlGS:0000000000000000\\n[   86.324291] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[   86.325314] CR2: 0000000000000092 CR3: 000000002f13a000 CR4: 0000000000350ef0\\n[   86.326589] Call Trace:\\n[   86.327036]  \u003cTASK\u003e\\n[   86.327434] ? show_regs (/build/work/knet/arch/x86/kernel/dumpstack.c:479)\\n[   86.328049] ? __die (/build/work/knet/arch/x86/kernel/dumpstack.c:421 /build/work/knet/arch/x86/kernel/dumpstack.c:434)\\n[   86.328508] ? page_fault_oops (/build/work/knet/arch/x86/mm/fault.c:707)\\n[   86.329107] ? do_user_addr_fault (/build/work/knet/arch/x86/mm/fault.c:1264)\\n[   86.329756] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223)\\n[   86.330350] ? __irq_work_queue_local (/build/work/knet/kernel/irq_work.c:111 (discriminator 1))\\n[   86.331013] ? exc_page_fault (/build/work/knet/./arch/x86/include/asm/paravirt.h:693 /build/work/knet/arch/x86/mm/fault.c:1515 /build/work/knet/arch/x86/mm/fault.c:1563)\\n[   86.331702] ? asm_exc_page_fault (/build/work/knet/./arch/x86/include/asm/idtentry.h:570)\\n[   86.332468] ? ip_mr_forward (/build/work/knet/net/ipv4/ipmr.c:1985)\\n[   86.333183] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223)\\n[   86.333920] ipmr_mfc_add (/build/work/knet/./include/linux/rcupdate.h:782 /build/work/knet/net/ipv4/ipmr.c:1009 /build/work/knet/net/ipv4/ipmr.c:1273)\\n[   86.334583] ? __pfx_ipmr_hash_cmp (/build/work/knet/net/ipv4/ipmr.c:363)\\n[   86.335357] ip_mroute_setsockopt (/build/work/knet/net/ipv4/ipmr.c:1470)\\n[   86.336135] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223)\\n[   86.336854] ? ip_mroute_setsockopt (/build/work/knet/net/ipv4/ipmr.c:1470)\\n[   86.337679] do_ip_setsockopt (/build/work/knet/net/ipv4/ip_sockglue.c:944)\\n[   86.338408] ? __pfx_unix_stream_read_actor (/build/work/knet/net/unix/af_unix.c:2862)\\n[   86.339232] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223)\\n[   86.339809] ? aa_sk_perm (/build/work/knet/security/apparmor/include/cred.h:153 /build/work/knet/security/apparmor/net.c:181)\\n[   86.340342] ip_setsockopt (/build/work/knet/net/ipv4/ip_sockglue.c:1415)\\n[   86.340859] raw_setsockopt (/build/work/knet/net/ipv4/raw.c:836)\\n[   86.341408] ? security_socket_setsockopt (/build/work/knet/security/security.c:4561 (discriminator 13))\\n[   86.342116] sock_common_setsockopt (/build/work/knet/net/core/sock.c:3716)\\n[   86.342747] do_sock_setsockopt (/build/work/knet/net/socket.c:2313)\\n[   86.343363] __sys_setsockopt (/build/work/knet/./include/linux/file.h:32 /build/work/kn\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.77\", \"versionStartIncluding\": \"6.1.75\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.16\", \"versionStartIncluding\": \"6.6.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.4\", \"versionStartIncluding\": \"6.7.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:26:22.586Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26626\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:26:22.586Z\", \"dateReserved\": \"2024-02-19T14:20:24.135Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-03-06T06:45:33.826Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.