CVE-2024-26826 (GCVE-0-2024-26826)
Vulnerability from cvelistv5
Published
2024-04-17 09:43
Modified
2026-08-05 11:27
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data re-injection from stale subflow When the MPTCP PM detects that a subflow is stale, all the packet scheduler must re-inject all the mptcp-level unacked data. To avoid acquiring unneeded locks, it first try to check if any unacked data is present at all in the RTX queue, but such check is currently broken, as it uses TCP-specific helper on an MPTCP socket. Funnily enough fuzzers and static checkers are happy, as the accessed memory still belongs to the mptcp_sock struct, and even from a functional perspective the recovery completed successfully, as the short-cut test always failed. A recent unrelated TCP change - commit d5fed5addb2b ("tcp: reorganize tcp_sock fast path variables") - exposed the issue, as the tcp field reorganization makes the mptcp code always skip the re-inection. Fix the issue dropping the bogus call: we are on a slow path, the early optimization proved once again to be evil.
References
Impacted products
Vendor Product Version
Linux Linux Version: 1e1d9d6f119c55c05e8ea78ed3e49046690abffd
Version: 1e1d9d6f119c55c05e8ea78ed3e49046690abffd
Version: 1e1d9d6f119c55c05e8ea78ed3e49046690abffd
Version: 1e1d9d6f119c55c05e8ea78ed3e49046690abffd
Version: 1e1d9d6f119c55c05e8ea78ed3e49046690abffd
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.531Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6f95120f898b40d13fd441225ef511307853c9c2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6673d9f1c2cd984390550dbdf7d5ae07b20abbf8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b609c783c535493aa3fca22c7e40a120370b1ca5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/624902eab7abcb8731b333ec73f206d38d839cd8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b6c620dc43ccb4e802894e54b651cf81495e9598"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26826",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:49:00.883183Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:30.420Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6f95120f898b40d13fd441225ef511307853c9c2",
              "status": "affected",
              "version": "1e1d9d6f119c55c05e8ea78ed3e49046690abffd",
              "versionType": "git"
            },
            {
              "lessThan": "6673d9f1c2cd984390550dbdf7d5ae07b20abbf8",
              "status": "affected",
              "version": "1e1d9d6f119c55c05e8ea78ed3e49046690abffd",
              "versionType": "git"
            },
            {
              "lessThan": "b609c783c535493aa3fca22c7e40a120370b1ca5",
              "status": "affected",
              "version": "1e1d9d6f119c55c05e8ea78ed3e49046690abffd",
              "versionType": "git"
            },
            {
              "lessThan": "624902eab7abcb8731b333ec73f206d38d839cd8",
              "status": "affected",
              "version": "1e1d9d6f119c55c05e8ea78ed3e49046690abffd",
              "versionType": "git"
            },
            {
              "lessThan": "b6c620dc43ccb4e802894e54b651cf81495e9598",
              "status": "affected",
              "version": "1e1d9d6f119c55c05e8ea78ed3e49046690abffd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.149",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.79",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.18",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.6",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix data re-injection from stale subflow\n\nWhen the MPTCP PM detects that a subflow is stale, all the packet\nscheduler must re-inject all the mptcp-level unacked data. To avoid\nacquiring unneeded locks, it first try to check if any unacked data\nis present at all in the RTX queue, but such check is currently\nbroken, as it uses TCP-specific helper on an MPTCP socket.\n\nFunnily enough fuzzers and static checkers are happy, as the accessed\nmemory still belongs to the mptcp_sock struct, and even from a\nfunctional perspective the recovery completed successfully, as\nthe short-cut test always failed.\n\nA recent unrelated TCP change - commit d5fed5addb2b (\"tcp: reorganize\ntcp_sock fast path variables\") - exposed the issue, as the tcp field\nreorganization makes the mptcp code always skip the re-inection.\n\nFix the issue dropping the bogus call: we are on a slow path, the early\noptimization proved once again to be evil."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable path is only reached from remote-peer-driven MPTCP events \u2014 stale-subflow detection when a peer stops ACKing on a path, and subflow teardown via RST/MP_TCPRST/RM_ADDR. No local access to the target is involved.\nAC:L - A malicious MPTCP peer controls every precondition: it creates the additional subflow via MP_JOIN/ADD_ADDR and then stalls or resets it while the target is sending. There is no race to win and the outcome is deterministic on affected builds.\nPR:N - The attacker is simply the remote end of an MPTCP connection to a listening service and needs no credentials or account on the target host. The stale/close handling runs on any established MPTCP connection.\nUI:N - The condition is driven entirely by the attacker\u0027s own packet behavior on an established connection. No action by a local user or administrator is required.\nS:U - The impact is confined to the MPTCP stack of the same kernel and the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:N - The type-confused read stays within the mptcp_sock allocation and its result only selects a code path; no memory contents are returned to userspace or transmitted to the peer. There is no information disclosure.\nI:N - No memory is written out of bounds and no data in transit is corrupted \u2014 MPTCP DSS sequencing still guarantees in-order delivery, and I confirmed the RTX timer still covers fully-sent dfrags while the push path completes partially-sent ones. Nothing is silently modified.\nA:H - With re-injection disabled, recovery falls back to retransmitting a single head fragment per RTO, so an attacker who blackholes one path can indefinitely stall data transfer on the connection while the receiver is head-of-line blocked and kernel sndbuf memory stays pinned. The attacker sustains and repeats this at will across connections, amounting to a denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:27:40.642Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6f95120f898b40d13fd441225ef511307853c9c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/6673d9f1c2cd984390550dbdf7d5ae07b20abbf8"
        },
        {
          "url": "https://git.kernel.org/stable/c/b609c783c535493aa3fca22c7e40a120370b1ca5"
        },
        {
          "url": "https://git.kernel.org/stable/c/624902eab7abcb8731b333ec73f206d38d839cd8"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6c620dc43ccb4e802894e54b651cf81495e9598"
        }
      ],
      "title": "mptcp: fix data re-injection from stale subflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26826",
    "datePublished": "2024-04-17T09:43:51.741Z",
    "dateReserved": "2024-02-19T14:20:24.181Z",
    "dateUpdated": "2026-08-05T11:27:40.642Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/6f95120f898b40d13fd441225ef511307853c9c2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/6673d9f1c2cd984390550dbdf7d5ae07b20abbf8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b609c783c535493aa3fca22c7e40a120370b1ca5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/624902eab7abcb8731b333ec73f206d38d839cd8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b6c620dc43ccb4e802894e54b651cf81495e9598\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.531Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26826\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:49:00.883183Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:17.040Z\"}}], \"cna\": {\"title\": \"mptcp: fix data re-injection from stale subflow\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The vulnerable path is only reached from remote-peer-driven MPTCP events \\u2014 stale-subflow detection when a peer stops ACKing on a path, and subflow teardown via RST/MP_TCPRST/RM_ADDR. No local access to the target is involved.\\nAC:L - A malicious MPTCP peer controls every precondition: it creates the additional subflow via MP_JOIN/ADD_ADDR and then stalls or resets it while the target is sending. There is no race to win and the outcome is deterministic on affected builds.\\nPR:N - The attacker is simply the remote end of an MPTCP connection to a listening service and needs no credentials or account on the target host. The stale/close handling runs on any established MPTCP connection.\\nUI:N - The condition is driven entirely by the attacker\u0027s own packet behavior on an established connection. No action by a local user or administrator is required.\\nS:U - The impact is confined to the MPTCP stack of the same kernel and the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\\nC:N - The type-confused read stays within the mptcp_sock allocation and its result only selects a code path; no memory contents are returned to userspace or transmitted to the peer. There is no information disclosure.\\nI:N - No memory is written out of bounds and no data in transit is corrupted \\u2014 MPTCP DSS sequencing still guarantees in-order delivery, and I confirmed the RTX timer still covers fully-sent dfrags while the push path completes partially-sent ones. Nothing is silently modified.\\nA:H - With re-injection disabled, recovery falls back to retransmitting a single head fragment per RTO, so an attacker who blackholes one path can indefinitely stall data transfer on the connection while the receiver is head-of-line blocked and kernel sndbuf memory stays pinned. The attacker sustains and repeats this at will across connections, amounting to a denial of service.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1e1d9d6f119c55c05e8ea78ed3e49046690abffd\", \"lessThan\": \"6f95120f898b40d13fd441225ef511307853c9c2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1e1d9d6f119c55c05e8ea78ed3e49046690abffd\", \"lessThan\": \"6673d9f1c2cd984390550dbdf7d5ae07b20abbf8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1e1d9d6f119c55c05e8ea78ed3e49046690abffd\", \"lessThan\": \"b609c783c535493aa3fca22c7e40a120370b1ca5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1e1d9d6f119c55c05e8ea78ed3e49046690abffd\", \"lessThan\": \"624902eab7abcb8731b333ec73f206d38d839cd8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1e1d9d6f119c55c05e8ea78ed3e49046690abffd\", \"lessThan\": \"b6c620dc43ccb4e802894e54b651cf81495e9598\", \"versionType\": \"git\"}], \"programFiles\": [\"net/mptcp/protocol.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.149\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.79\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.18\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/mptcp/protocol.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/6f95120f898b40d13fd441225ef511307853c9c2\"}, {\"url\": \"https://git.kernel.org/stable/c/6673d9f1c2cd984390550dbdf7d5ae07b20abbf8\"}, {\"url\": \"https://git.kernel.org/stable/c/b609c783c535493aa3fca22c7e40a120370b1ca5\"}, {\"url\": \"https://git.kernel.org/stable/c/624902eab7abcb8731b333ec73f206d38d839cd8\"}, {\"url\": \"https://git.kernel.org/stable/c/b6c620dc43ccb4e802894e54b651cf81495e9598\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmptcp: fix data re-injection from stale subflow\\n\\nWhen the MPTCP PM detects that a subflow is stale, all the packet\\nscheduler must re-inject all the mptcp-level unacked data. To avoid\\nacquiring unneeded locks, it first try to check if any unacked data\\nis present at all in the RTX queue, but such check is currently\\nbroken, as it uses TCP-specific helper on an MPTCP socket.\\n\\nFunnily enough fuzzers and static checkers are happy, as the accessed\\nmemory still belongs to the mptcp_sock struct, and even from a\\nfunctional perspective the recovery completed successfully, as\\nthe short-cut test always failed.\\n\\nA recent unrelated TCP change - commit d5fed5addb2b (\\\"tcp: reorganize\\ntcp_sock fast path variables\\\") - exposed the issue, as the tcp field\\nreorganization makes the mptcp code always skip the re-inection.\\n\\nFix the issue dropping the bogus call: we are on a slow path, the early\\noptimization proved once again to be evil.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.149\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.79\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.18\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.6\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"5.15\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:27:40.642Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26826\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:27:40.642Z\", \"dateReserved\": \"2024-02-19T14:20:24.181Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-17T09:43:51.741Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.