CVE-2024-26826

Medium

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data re-injection from stale subflow When the MPTCP PM detects that a subflow is stale, all the packet scheduler must re-inject all the mptcp-level unacked data. To avoid acquiring unneeded locks, it first try to check if any unacked data is present at all in the RTX queue, but such check is currently broken, as it uses TCP-specific helper on an MPTCP socket. Funnily enough fuzzers and static checkers are happy, as the accessed memory still belongs to the mptcp_sock struct, and even from a functional perspective the recovery completed successfully, as the short-cut test always failed. A recent unrelated TCP change - commit d5fed5addb2b ("tcp: reorganize tcp_sock fast path variables") - exposed the issue, as the tcp field reorganization makes the mptcp code always skip the re-inection. Fix the issue dropping the bogus call: we are on a slow path, the early optimization proved once again to be evil.

Package Linux Kernel
Published 2024-04-17
Last modified 2025-03-27
CVSS version 3.1
Patch available
Yes

CVSS 3.1 score

5.5

out of 10
Medium
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected versions

Linux kernel versions 5.15 and later are affected. Fixed in 5.15.149, 6.1.79, 6.6.18, 6.7.6, 6.8 and their respective stable series.

Affected from
≥ 5.15
Fixed in
✓ 5.15.149 5.15.x ✓ 6.1.79 6.1.x ✓ 6.6.18 6.6.x ✓ 6.7.6 6.7.x ✓ 6.8

References

5 total

Frequently asked questions

  • What is CVE-2024-26826?

    CVE-2024-26826 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 . It affects Linux kernel versions from 5.15 onward and has been patched in 5.15.149, 6.1.79, 6.6.18 and others. CVE-2024-26826 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

  • What is the CVSS score for CVE-2024-26826?

    CVE-2024-26826 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H .

  • Is there a patch available for CVE-2024-26826?

    Yes. CVE-2024-26826 has been patched. Fixed versions include 5.15.149, 6.1.79, 6.6.18 and others. If you are running Linux kernel 5.15 or later up to the fix versions, apply the relevant patch for your kernel branch.

  • Is CVE-2024-26826 actively exploited?

    No. CVE-2024-26826 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Back to
All CVEs
View on
NVD / NIST