CVE-2024-26782 (GCVE-0-2024-26782)
Vulnerability from cvelistv5 – Published: 2024-04-04 08:20 – Updated: 2026-05-11 20:04
VLAI
Title
mptcp: fix double-free on socket dismantle
Summary
In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix double-free on socket dismantle
when MPTCP server accepts an incoming connection, it clones its listener
socket. However, the pointer to 'inet_opt' for the new socket has the same
value as the original one: as a consequence, on program exit it's possible
to observe the following splat:
BUG: KASAN: double-free in inet_sock_destruct+0x54f/0x8b0
Free of addr ffff888485950880 by task swapper/25/0
CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Not tainted 6.8.0-rc1+ #609
Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0 07/26/2013
Call Trace:
<IRQ>
dump_stack_lvl+0x32/0x50
print_report+0xca/0x620
kasan_report_invalid_free+0x64/0x90
__kasan_slab_free+0x1aa/0x1f0
kfree+0xed/0x2e0
inet_sock_destruct+0x54f/0x8b0
__sk_destruct+0x48/0x5b0
rcu_do_batch+0x34e/0xd90
rcu_core+0x559/0xac0
__do_softirq+0x183/0x5a4
irq_exit_rcu+0x12d/0x170
sysvec_apic_timer_interrupt+0x6b/0x80
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x16/0x20
RIP: 0010:cpuidle_enter_state+0x175/0x300
Code: 30 00 0f 84 1f 01 00 00 83 e8 01 83 f8 ff 75 e5 48 83 c4 18 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc fb 45 85 ed <0f> 89 60 ff ff ff 48 c1 e5 06 48 c7 43 18 00 00 00 00 48 83 44 2b
RSP: 0018:ffff888481cf7d90 EFLAGS: 00000202
RAX: 0000000000000000 RBX: ffff88887facddc8 RCX: 0000000000000000
RDX: 1ffff1110ff588b1 RSI: 0000000000000019 RDI: ffff88887fac4588
RBP: 0000000000000004 R08: 0000000000000002 R09: 0000000000043080
R10: 0009b02ea273363f R11: ffff88887fabf42b R12: ffffffff932592e0
R13: 0000000000000004 R14: 0000000000000000 R15: 00000022c880ec80
cpuidle_enter+0x4a/0xa0
do_idle+0x310/0x410
cpu_startup_entry+0x51/0x60
start_secondary+0x211/0x270
secondary_startup_64_no_verify+0x184/0x18b
</TASK>
Allocated by task 6853:
kasan_save_stack+0x1c/0x40
kasan_save_track+0x10/0x30
__kasan_kmalloc+0xa6/0xb0
__kmalloc+0x1eb/0x450
cipso_v4_sock_setattr+0x96/0x360
netlbl_sock_setattr+0x132/0x1f0
selinux_netlbl_socket_post_create+0x6c/0x110
selinux_socket_post_create+0x37b/0x7f0
security_socket_post_create+0x63/0xb0
__sock_create+0x305/0x450
__sys_socket_create.part.23+0xbd/0x130
__sys_socket+0x37/0xb0
__x64_sys_socket+0x6f/0xb0
do_syscall_64+0x83/0x160
entry_SYSCALL_64_after_hwframe+0x6e/0x76
Freed by task 6858:
kasan_save_stack+0x1c/0x40
kasan_save_track+0x10/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x12c/0x1f0
kfree+0xed/0x2e0
inet_sock_destruct+0x54f/0x8b0
__sk_destruct+0x48/0x5b0
subflow_ulp_release+0x1f0/0x250
tcp_cleanup_ulp+0x6e/0x110
tcp_v4_destroy_sock+0x5a/0x3a0
inet_csk_destroy_sock+0x135/0x390
tcp_fin+0x416/0x5c0
tcp_data_queue+0x1bc8/0x4310
tcp_rcv_state_process+0x15a3/0x47b0
tcp_v4_do_rcv+0x2c1/0x990
tcp_v4_rcv+0x41fb/0x5ed0
ip_protocol_deliver_rcu+0x6d/0x9f0
ip_local_deliver_finish+0x278/0x360
ip_local_deliver+0x182/0x2c0
ip_rcv+0xb5/0x1c0
__netif_receive_skb_one_core+0x16e/0x1b0
process_backlog+0x1e3/0x650
__napi_poll+0xa6/0x500
net_rx_action+0x740/0xbb0
__do_softirq+0x183/0x5a4
The buggy address belongs to the object at ffff888485950880
which belongs to the cache kmalloc-64 of size 64
The buggy address is located 0 bytes inside of
64-byte region [ffff888485950880, ffff8884859508c0)
The buggy address belongs to the physical page:
page:0000000056d1e95e refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888485950700 pfn:0x485950
flags: 0x57ffffc0000800(slab|node=1|zone=2|lastcpupid=0x1fffff)
page_type: 0xffffffff()
raw: 0057ffffc0000800 ffff88810004c640 ffffea00121b8ac0 dead000000000006
raw: ffff888485950700 0000000000200019 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888485950780: fa fb fb
---truncated---
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be , < f74362a004225df935863dea6eb7d82daaa5b16e
(git)
Affected: cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be , < 4a4eeb6912538c2d0b158e8d11b62d96c1dada4e (git) Affected: cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be , < d93fd40c62397326046902a2c5cb75af50882a85 (git) Affected: cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be , < ce0809ada38dca8d6d41bb57ab40494855c30582 (git) Affected: cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be , < 85933e80d077c9ae2227226beb86c22f464059cc (git) Affected: cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be , < 10048689def7e40a4405acda16fdc6477d4ecc5c (git) |
|
| Linux | Linux |
Affected:
5.6
Unaffected: 0 , < 5.6 (semver) Unaffected: 5.10.212 , ≤ 5.10.* (semver) Unaffected: 5.15.151 , ≤ 5.15.* (semver) Unaffected: 6.1.81 , ≤ 6.1.* (semver) Unaffected: 6.6.21 , ≤ 6.6.* (semver) Unaffected: 6.7.9 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:14:13.370Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/f74362a004225df935863dea6eb7d82daaa5b16e"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/4a4eeb6912538c2d0b158e8d11b62d96c1dada4e"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/d93fd40c62397326046902a2c5cb75af50882a85"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/ce0809ada38dca8d6d41bb57ab40494855c30582"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/85933e80d077c9ae2227226beb86c22f464059cc"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/10048689def7e40a4405acda16fdc6477d4ecc5c"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-26782",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T15:51:05.325955Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T17:33:51.835Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mptcp/protocol.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f74362a004225df935863dea6eb7d82daaa5b16e",
"status": "affected",
"version": "cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be",
"versionType": "git"
},
{
"lessThan": "4a4eeb6912538c2d0b158e8d11b62d96c1dada4e",
"status": "affected",
"version": "cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be",
"versionType": "git"
},
{
"lessThan": "d93fd40c62397326046902a2c5cb75af50882a85",
"status": "affected",
"version": "cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be",
"versionType": "git"
},
{
"lessThan": "ce0809ada38dca8d6d41bb57ab40494855c30582",
"status": "affected",
"version": "cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be",
"versionType": "git"
},
{
"lessThan": "85933e80d077c9ae2227226beb86c22f464059cc",
"status": "affected",
"version": "cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be",
"versionType": "git"
},
{
"lessThan": "10048689def7e40a4405acda16fdc6477d4ecc5c",
"status": "affected",
"version": "cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mptcp/protocol.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.7.*",
"status": "unaffected",
"version": "6.7.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.8",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.212",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.151",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.81",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.21",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.7.9",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix double-free on socket dismantle\n\nwhen MPTCP server accepts an incoming connection, it clones its listener\nsocket. However, the pointer to \u0027inet_opt\u0027 for the new socket has the same\nvalue as the original one: as a consequence, on program exit it\u0027s possible\nto observe the following splat:\n\n BUG: KASAN: double-free in inet_sock_destruct+0x54f/0x8b0\n Free of addr ffff888485950880 by task swapper/25/0\n\n CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Not tainted 6.8.0-rc1+ #609\n Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0 07/26/2013\n Call Trace:\n \u003cIRQ\u003e\n dump_stack_lvl+0x32/0x50\n print_report+0xca/0x620\n kasan_report_invalid_free+0x64/0x90\n __kasan_slab_free+0x1aa/0x1f0\n kfree+0xed/0x2e0\n inet_sock_destruct+0x54f/0x8b0\n __sk_destruct+0x48/0x5b0\n rcu_do_batch+0x34e/0xd90\n rcu_core+0x559/0xac0\n __do_softirq+0x183/0x5a4\n irq_exit_rcu+0x12d/0x170\n sysvec_apic_timer_interrupt+0x6b/0x80\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n asm_sysvec_apic_timer_interrupt+0x16/0x20\n RIP: 0010:cpuidle_enter_state+0x175/0x300\n Code: 30 00 0f 84 1f 01 00 00 83 e8 01 83 f8 ff 75 e5 48 83 c4 18 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc fb 45 85 ed \u003c0f\u003e 89 60 ff ff ff 48 c1 e5 06 48 c7 43 18 00 00 00 00 48 83 44 2b\n RSP: 0018:ffff888481cf7d90 EFLAGS: 00000202\n RAX: 0000000000000000 RBX: ffff88887facddc8 RCX: 0000000000000000\n RDX: 1ffff1110ff588b1 RSI: 0000000000000019 RDI: ffff88887fac4588\n RBP: 0000000000000004 R08: 0000000000000002 R09: 0000000000043080\n R10: 0009b02ea273363f R11: ffff88887fabf42b R12: ffffffff932592e0\n R13: 0000000000000004 R14: 0000000000000000 R15: 00000022c880ec80\n cpuidle_enter+0x4a/0xa0\n do_idle+0x310/0x410\n cpu_startup_entry+0x51/0x60\n start_secondary+0x211/0x270\n secondary_startup_64_no_verify+0x184/0x18b\n \u003c/TASK\u003e\n\n Allocated by task 6853:\n kasan_save_stack+0x1c/0x40\n kasan_save_track+0x10/0x30\n __kasan_kmalloc+0xa6/0xb0\n __kmalloc+0x1eb/0x450\n cipso_v4_sock_setattr+0x96/0x360\n netlbl_sock_setattr+0x132/0x1f0\n selinux_netlbl_socket_post_create+0x6c/0x110\n selinux_socket_post_create+0x37b/0x7f0\n security_socket_post_create+0x63/0xb0\n __sock_create+0x305/0x450\n __sys_socket_create.part.23+0xbd/0x130\n __sys_socket+0x37/0xb0\n __x64_sys_socket+0x6f/0xb0\n do_syscall_64+0x83/0x160\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\n\n Freed by task 6858:\n kasan_save_stack+0x1c/0x40\n kasan_save_track+0x10/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x12c/0x1f0\n kfree+0xed/0x2e0\n inet_sock_destruct+0x54f/0x8b0\n __sk_destruct+0x48/0x5b0\n subflow_ulp_release+0x1f0/0x250\n tcp_cleanup_ulp+0x6e/0x110\n tcp_v4_destroy_sock+0x5a/0x3a0\n inet_csk_destroy_sock+0x135/0x390\n tcp_fin+0x416/0x5c0\n tcp_data_queue+0x1bc8/0x4310\n tcp_rcv_state_process+0x15a3/0x47b0\n tcp_v4_do_rcv+0x2c1/0x990\n tcp_v4_rcv+0x41fb/0x5ed0\n ip_protocol_deliver_rcu+0x6d/0x9f0\n ip_local_deliver_finish+0x278/0x360\n ip_local_deliver+0x182/0x2c0\n ip_rcv+0xb5/0x1c0\n __netif_receive_skb_one_core+0x16e/0x1b0\n process_backlog+0x1e3/0x650\n __napi_poll+0xa6/0x500\n net_rx_action+0x740/0xbb0\n __do_softirq+0x183/0x5a4\n\n The buggy address belongs to the object at ffff888485950880\n which belongs to the cache kmalloc-64 of size 64\n The buggy address is located 0 bytes inside of\n 64-byte region [ffff888485950880, ffff8884859508c0)\n\n The buggy address belongs to the physical page:\n page:0000000056d1e95e refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888485950700 pfn:0x485950\n flags: 0x57ffffc0000800(slab|node=1|zone=2|lastcpupid=0x1fffff)\n page_type: 0xffffffff()\n raw: 0057ffffc0000800 ffff88810004c640 ffffea00121b8ac0 dead000000000006\n raw: ffff888485950700 0000000000200019 00000001ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n ffff888485950780: fa fb fb\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T20:04:04.888Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f74362a004225df935863dea6eb7d82daaa5b16e"
},
{
"url": "https://git.kernel.org/stable/c/4a4eeb6912538c2d0b158e8d11b62d96c1dada4e"
},
{
"url": "https://git.kernel.org/stable/c/d93fd40c62397326046902a2c5cb75af50882a85"
},
{
"url": "https://git.kernel.org/stable/c/ce0809ada38dca8d6d41bb57ab40494855c30582"
},
{
"url": "https://git.kernel.org/stable/c/85933e80d077c9ae2227226beb86c22f464059cc"
},
{
"url": "https://git.kernel.org/stable/c/10048689def7e40a4405acda16fdc6477d4ecc5c"
}
],
"title": "mptcp: fix double-free on socket dismantle",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-26782",
"datePublished": "2024-04-04T08:20:16.472Z",
"dateReserved": "2024-02-19T14:20:24.177Z",
"dateUpdated": "2026-05-11T20:04:04.888Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2024-26782",
"date": "2026-06-19",
"epss": "0.0024",
"percentile": "0.14821"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.6\", \"versionEndExcluding\": \"5.10.212\", \"matchCriteriaId\": \"1DCB3708-5DB7-49ED-84B1-DA0C5BF4659A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.151\", \"matchCriteriaId\": \"EEAFD33E-C22F-4FB1-A417-9C96AB3E0358\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.81\", \"matchCriteriaId\": \"EC825B0E-DFCA-4034-9B92-F111A4E2A732\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.21\", \"matchCriteriaId\": \"B19074A2-9FE5-4E7D-9E2D-020F95013ADA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.7.9\", \"matchCriteriaId\": \"1C538467-EDA0-4A9A-82EB-2925DE9FF827\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"B9F4EA73-0894-400F-A490-3A397AB7A517\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"056BD938-0A27-4569-B391-30578B309EE3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"F02056A5-B362-4370-9FF8-6F0BD384D520\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"A780F817-2A77-4130-A9B7-5C25606314E3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"AEB9199B-AB8F-4877-8964-E2BA95B5F15C\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmptcp: fix double-free on socket dismantle\\n\\nwhen MPTCP server accepts an incoming connection, it clones its listener\\nsocket. However, the pointer to \u0027inet_opt\u0027 for the new socket has the same\\nvalue as the original one: as a consequence, on program exit it\u0027s possible\\nto observe the following splat:\\n\\n BUG: KASAN: double-free in inet_sock_destruct+0x54f/0x8b0\\n Free of addr ffff888485950880 by task swapper/25/0\\n\\n CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Not tainted 6.8.0-rc1+ #609\\n Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0 07/26/2013\\n Call Trace:\\n \u003cIRQ\u003e\\n dump_stack_lvl+0x32/0x50\\n print_report+0xca/0x620\\n kasan_report_invalid_free+0x64/0x90\\n __kasan_slab_free+0x1aa/0x1f0\\n kfree+0xed/0x2e0\\n inet_sock_destruct+0x54f/0x8b0\\n __sk_destruct+0x48/0x5b0\\n rcu_do_batch+0x34e/0xd90\\n rcu_core+0x559/0xac0\\n __do_softirq+0x183/0x5a4\\n irq_exit_rcu+0x12d/0x170\\n sysvec_apic_timer_interrupt+0x6b/0x80\\n \u003c/IRQ\u003e\\n \u003cTASK\u003e\\n asm_sysvec_apic_timer_interrupt+0x16/0x20\\n RIP: 0010:cpuidle_enter_state+0x175/0x300\\n Code: 30 00 0f 84 1f 01 00 00 83 e8 01 83 f8 ff 75 e5 48 83 c4 18 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc fb 45 85 ed \u003c0f\u003e 89 60 ff ff ff 48 c1 e5 06 48 c7 43 18 00 00 00 00 48 83 44 2b\\n RSP: 0018:ffff888481cf7d90 EFLAGS: 00000202\\n RAX: 0000000000000000 RBX: ffff88887facddc8 RCX: 0000000000000000\\n RDX: 1ffff1110ff588b1 RSI: 0000000000000019 RDI: ffff88887fac4588\\n RBP: 0000000000000004 R08: 0000000000000002 R09: 0000000000043080\\n R10: 0009b02ea273363f R11: ffff88887fabf42b R12: ffffffff932592e0\\n R13: 0000000000000004 R14: 0000000000000000 R15: 00000022c880ec80\\n cpuidle_enter+0x4a/0xa0\\n do_idle+0x310/0x410\\n cpu_startup_entry+0x51/0x60\\n start_secondary+0x211/0x270\\n secondary_startup_64_no_verify+0x184/0x18b\\n \u003c/TASK\u003e\\n\\n Allocated by task 6853:\\n kasan_save_stack+0x1c/0x40\\n kasan_save_track+0x10/0x30\\n __kasan_kmalloc+0xa6/0xb0\\n __kmalloc+0x1eb/0x450\\n cipso_v4_sock_setattr+0x96/0x360\\n netlbl_sock_setattr+0x132/0x1f0\\n selinux_netlbl_socket_post_create+0x6c/0x110\\n selinux_socket_post_create+0x37b/0x7f0\\n security_socket_post_create+0x63/0xb0\\n __sock_create+0x305/0x450\\n __sys_socket_create.part.23+0xbd/0x130\\n __sys_socket+0x37/0xb0\\n __x64_sys_socket+0x6f/0xb0\\n do_syscall_64+0x83/0x160\\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\\n\\n Freed by task 6858:\\n kasan_save_stack+0x1c/0x40\\n kasan_save_track+0x10/0x30\\n kasan_save_free_info+0x3b/0x60\\n __kasan_slab_free+0x12c/0x1f0\\n kfree+0xed/0x2e0\\n inet_sock_destruct+0x54f/0x8b0\\n __sk_destruct+0x48/0x5b0\\n subflow_ulp_release+0x1f0/0x250\\n tcp_cleanup_ulp+0x6e/0x110\\n tcp_v4_destroy_sock+0x5a/0x3a0\\n inet_csk_destroy_sock+0x135/0x390\\n tcp_fin+0x416/0x5c0\\n tcp_data_queue+0x1bc8/0x4310\\n tcp_rcv_state_process+0x15a3/0x47b0\\n tcp_v4_do_rcv+0x2c1/0x990\\n tcp_v4_rcv+0x41fb/0x5ed0\\n ip_protocol_deliver_rcu+0x6d/0x9f0\\n ip_local_deliver_finish+0x278/0x360\\n ip_local_deliver+0x182/0x2c0\\n ip_rcv+0xb5/0x1c0\\n __netif_receive_skb_one_core+0x16e/0x1b0\\n process_backlog+0x1e3/0x650\\n __napi_poll+0xa6/0x500\\n net_rx_action+0x740/0xbb0\\n __do_softirq+0x183/0x5a4\\n\\n The buggy address belongs to the object at ffff888485950880\\n which belongs to the cache kmalloc-64 of size 64\\n The buggy address is located 0 bytes inside of\\n 64-byte region [ffff888485950880, ffff8884859508c0)\\n\\n The buggy address belongs to the physical page:\\n page:0000000056d1e95e refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888485950700 pfn:0x485950\\n flags: 0x57ffffc0000800(slab|node=1|zone=2|lastcpupid=0x1fffff)\\n page_type: 0xffffffff()\\n raw: 0057ffffc0000800 ffff88810004c640 ffffea00121b8ac0 dead000000000006\\n raw: ffff888485950700 0000000000200019 00000001ffffffff 0000000000000000\\n page dumped because: kasan: bad access detected\\n\\n Memory state around the buggy address:\\n ffff888485950780: fa fb fb\\n---truncated---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mptcp: corrige la doble liberaci\\u00f3n al desmantelar el socket cuando el servidor MPTCP acepta una conexi\\u00f3n entrante, clona su socket de escucha. Sin embargo, el puntero a \u0027inet_opt\u0027 para el nuevo socket tiene el mismo valor que el original: como consecuencia, al salir del programa es posible observar el siguiente s\\u00edmbolo: ERROR: KASAN: double-free in inet_sock_destruct+0x54f/0x8b0 Free de addr ffff888485950880 por task swapper/25/0 CPU: 25 PID: 0 Comm: swapper/25 Kdump: cargado No contaminado 6.8.0-rc1+ #609 Nombre de hardware: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF /iF, BIOS 3.0 26/07/2013 Seguimiento de llamadas: dump_stack_lvl+0x32/0x50 print_report+0xca/0x620 kasan_report_invalid_free+0x64/0x90 __kasan_slab_free+0x1aa/0x1f0 kfree+0xed/0x2e0 inet_sock_destruct+0x 54f/0x8b0 __sk_destruct+0x48/ 0x5b0 rcu_do_batch+0x34e/0xd90 rcu_core+0x559/0xac0 __do_softirq+0x183/0x5a4 irq_exit_rcu+0x12d/0x170 sysvec_apic_timer_interrupt+0x6b/0x80 asm_sysvec_apic _timer_interrupt+0x16/0x20 RIP: 0010:cpuidle_enter_state+0x175/0x300 C\\u00f3digo: 30 00 0f 84 1f 01 00 00 83 e8 01 83 f8 ff 75 e5 48 83 c4 18 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc fb 45 85 ed \u0026lt;0f\u0026gt; 89 60 ff ff ff 48 c1 e5 06 48 c7 43 18 00 00 00 00 48 83 44 2b RSP: 0018:ffff888481cf7d90 EFLAGS: 00000202 RAX: 00000000000000000 RBX: ffff88887facddc8 RCX: 00000 00000000000 RDX: 1ffff1110ff588b1 RSI: 0000000000000019 RDI: ffff88887fac4588 RBP: 00000000000000004 R08: 0000000000000002 R09: 0000000000043 080 R10: 0009b02ea273363f R11: ffff88887fabf42b R12: ffffffff932592e0 R13: 0000000000000004 R14: 00000000000000000 R15: 00000022c880ec80 cpuidle_enter+ 0x4a/0xa0 do_idle+0x310/0x410 cpu_startup_entry+0x51/0x60 start_secondary+0x211/0x270 second_startup_64_no_verify+0x184/0x18b Asignado por tarea 6853: kasan_save_stack+0x1c/0x40 kasan_save_track+0x10/0x30 __kasan_kmalloc+0xa6/0xb0 __kmalloc+0x1eb/0x450 cipso_v4_sock_setattr+0x96/0x360 netlbl_sock_setattr+0x132/0x1f0 selinux_net lbl_socket_post_create+0x6c/0x110 selinux_socket_post_create+0x37b/0x7f0 seguridad_socket_post_create+0x63/0xb0 __sock_create+0x305 /0x450 __sys_socket_create.part.23+0xbd/0x130 __sys_socket+0x37/0xb0 __x64_sys_socket+0x6f/0xb0 do_syscall_64+0x83/0x160 Entry_SYSCALL_64_after_hwframe+0x6e/0x76 Liberado por la tarea 68 58: kasan_save_stack+0x1c/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x3b/ 0x60 __kasan_slab_free+0x12c/0x1f0 kfree+0xed/0x2e0 inet_sock_destruct+0x54f/0x8b0 __sk_destruct+0x48/0x5b0 subflow_ulp_release+0x1f0/0x250 tcp_cleanup_ulp+0x6e/0x110 tcp_v4_destroy _sock+0x5a/0x3a0 inet_csk_destroy_sock+0x135/0x390 tcp_fin+0x416/0x5c0 tcp_data_queue+0x1bc8/ 0x4310 tcp_rcv_state_process+0x15a3/0x47b0 tcp_v4_do_rcv+0x2c1/0x990 tcp_v4_rcv+0x41fb/0x5ed0 ip_protocol_deliver_rcu+0x6d/0x9f0 ip_local_deliver_finish+0x278/0x360 ip_ local_deliver+0x182/0x2c0 ip_rcv+0xb5/0x1c0 __netif_receive_skb_one_core+0x16e/0x1b0 Process_backlog+0x1e3/0x650 __napi_poll+0xa6/ 0x500 net_rx_action+0x740/0xbb0 __do_softirq+0x183/0x5a4 La direcci\\u00f3n con errores pertenece al objeto en ffff888485950880 que pertenece al cach\\u00e9 kmalloc-64 de tama\\u00f1o 64. La direcci\\u00f3n con errores se encuentra a 0 bytes dentro de la regi\\u00f3n de 64 bytes [ffff888485950880, ffff88848 59508c0) El La direcci\\u00f3n con errores pertenece a la p\\u00e1gina f\\u00edsica: p\\u00e1gina:0000000056d1e95e refcount:1 mapcount:0 mapeo:0000000000000000 \\u00edndice:0xffff888485950700 pfn:0x485950 banderas: 0x57ffffc0000800(slab|node=1|zone=2|lastcpupid=0x1f ffff) tipo_p\\u00e1gina: 0xffffffff() sin procesar : 0057ffffc0000800 ffff88810004c640 ffffea00121b8ac0 dead000000000006 raw: ffff888485950700 0000000000200019 00000001ffffffff 0000000000000000 p\\u00e1gina volcada porque: kasan: se detect\\u00f3 mal acceso Estado de la memoria alrededor de la direcci\\u00f3n con errores: ffff888485950780: fa fb fb ---truncado---\"}]",
"id": "CVE-2024-26782",
"lastModified": "2025-01-10T17:44:44.130",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
"published": "2024-04-04T09:15:08.020",
"references": "[{\"url\": \"https://git.kernel.org/stable/c/10048689def7e40a4405acda16fdc6477d4ecc5c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4a4eeb6912538c2d0b158e8d11b62d96c1dada4e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/85933e80d077c9ae2227226beb86c22f464059cc\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ce0809ada38dca8d6d41bb57ab40494855c30582\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d93fd40c62397326046902a2c5cb75af50882a85\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f74362a004225df935863dea6eb7d82daaa5b16e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/10048689def7e40a4405acda16fdc6477d4ecc5c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4a4eeb6912538c2d0b158e8d11b62d96c1dada4e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/85933e80d077c9ae2227226beb86c22f464059cc\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ce0809ada38dca8d6d41bb57ab40494855c30582\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d93fd40c62397326046902a2c5cb75af50882a85\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f74362a004225df935863dea6eb7d82daaa5b16e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\"]}]",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Analyzed",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-415\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-26782\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-04T09:15:08.020\",\"lastModified\":\"2025-01-10T17:44:44.130\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmptcp: fix double-free on socket dismantle\\n\\nwhen MPTCP server accepts an incoming connection, it clones its listener\\nsocket. However, the pointer to \u0027inet_opt\u0027 for the new socket has the same\\nvalue as the original one: as a consequence, on program exit it\u0027s possible\\nto observe the following splat:\\n\\n BUG: KASAN: double-free in inet_sock_destruct+0x54f/0x8b0\\n Free of addr ffff888485950880 by task swapper/25/0\\n\\n CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Not tainted 6.8.0-rc1+ #609\\n Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0 07/26/2013\\n Call Trace:\\n \u003cIRQ\u003e\\n dump_stack_lvl+0x32/0x50\\n print_report+0xca/0x620\\n kasan_report_invalid_free+0x64/0x90\\n __kasan_slab_free+0x1aa/0x1f0\\n kfree+0xed/0x2e0\\n inet_sock_destruct+0x54f/0x8b0\\n __sk_destruct+0x48/0x5b0\\n rcu_do_batch+0x34e/0xd90\\n rcu_core+0x559/0xac0\\n __do_softirq+0x183/0x5a4\\n irq_exit_rcu+0x12d/0x170\\n sysvec_apic_timer_interrupt+0x6b/0x80\\n \u003c/IRQ\u003e\\n \u003cTASK\u003e\\n asm_sysvec_apic_timer_interrupt+0x16/0x20\\n RIP: 0010:cpuidle_enter_state+0x175/0x300\\n Code: 30 00 0f 84 1f 01 00 00 83 e8 01 83 f8 ff 75 e5 48 83 c4 18 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc fb 45 85 ed \u003c0f\u003e 89 60 ff ff ff 48 c1 e5 06 48 c7 43 18 00 00 00 00 48 83 44 2b\\n RSP: 0018:ffff888481cf7d90 EFLAGS: 00000202\\n RAX: 0000000000000000 RBX: ffff88887facddc8 RCX: 0000000000000000\\n RDX: 1ffff1110ff588b1 RSI: 0000000000000019 RDI: ffff88887fac4588\\n RBP: 0000000000000004 R08: 0000000000000002 R09: 0000000000043080\\n R10: 0009b02ea273363f R11: ffff88887fabf42b R12: ffffffff932592e0\\n R13: 0000000000000004 R14: 0000000000000000 R15: 00000022c880ec80\\n cpuidle_enter+0x4a/0xa0\\n do_idle+0x310/0x410\\n cpu_startup_entry+0x51/0x60\\n start_secondary+0x211/0x270\\n secondary_startup_64_no_verify+0x184/0x18b\\n \u003c/TASK\u003e\\n\\n Allocated by task 6853:\\n kasan_save_stack+0x1c/0x40\\n kasan_save_track+0x10/0x30\\n __kasan_kmalloc+0xa6/0xb0\\n __kmalloc+0x1eb/0x450\\n cipso_v4_sock_setattr+0x96/0x360\\n netlbl_sock_setattr+0x132/0x1f0\\n selinux_netlbl_socket_post_create+0x6c/0x110\\n selinux_socket_post_create+0x37b/0x7f0\\n security_socket_post_create+0x63/0xb0\\n __sock_create+0x305/0x450\\n __sys_socket_create.part.23+0xbd/0x130\\n __sys_socket+0x37/0xb0\\n __x64_sys_socket+0x6f/0xb0\\n do_syscall_64+0x83/0x160\\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\\n\\n Freed by task 6858:\\n kasan_save_stack+0x1c/0x40\\n kasan_save_track+0x10/0x30\\n kasan_save_free_info+0x3b/0x60\\n __kasan_slab_free+0x12c/0x1f0\\n kfree+0xed/0x2e0\\n inet_sock_destruct+0x54f/0x8b0\\n __sk_destruct+0x48/0x5b0\\n subflow_ulp_release+0x1f0/0x250\\n tcp_cleanup_ulp+0x6e/0x110\\n tcp_v4_destroy_sock+0x5a/0x3a0\\n inet_csk_destroy_sock+0x135/0x390\\n tcp_fin+0x416/0x5c0\\n tcp_data_queue+0x1bc8/0x4310\\n tcp_rcv_state_process+0x15a3/0x47b0\\n tcp_v4_do_rcv+0x2c1/0x990\\n tcp_v4_rcv+0x41fb/0x5ed0\\n ip_protocol_deliver_rcu+0x6d/0x9f0\\n ip_local_deliver_finish+0x278/0x360\\n ip_local_deliver+0x182/0x2c0\\n ip_rcv+0xb5/0x1c0\\n __netif_receive_skb_one_core+0x16e/0x1b0\\n process_backlog+0x1e3/0x650\\n __napi_poll+0xa6/0x500\\n net_rx_action+0x740/0xbb0\\n __do_softirq+0x183/0x5a4\\n\\n The buggy address belongs to the object at ffff888485950880\\n which belongs to the cache kmalloc-64 of size 64\\n The buggy address is located 0 bytes inside of\\n 64-byte region [ffff888485950880, ffff8884859508c0)\\n\\n The buggy address belongs to the physical page:\\n page:0000000056d1e95e refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888485950700 pfn:0x485950\\n flags: 0x57ffffc0000800(slab|node=1|zone=2|lastcpupid=0x1fffff)\\n page_type: 0xffffffff()\\n raw: 0057ffffc0000800 ffff88810004c640 ffffea00121b8ac0 dead000000000006\\n raw: ffff888485950700 0000000000200019 00000001ffffffff 0000000000000000\\n page dumped because: kasan: bad access detected\\n\\n Memory state around the buggy address:\\n ffff888485950780: fa fb fb\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mptcp: corrige la doble liberaci\u00f3n al desmantelar el socket cuando el servidor MPTCP acepta una conexi\u00f3n entrante, clona su socket de escucha. Sin embargo, el puntero a \u0027inet_opt\u0027 para el nuevo socket tiene el mismo valor que el original: como consecuencia, al salir del programa es posible observar el siguiente s\u00edmbolo: ERROR: KASAN: double-free in inet_sock_destruct+0x54f/0x8b0 Free de addr ffff888485950880 por task swapper/25/0 CPU: 25 PID: 0 Comm: swapper/25 Kdump: cargado No contaminado 6.8.0-rc1+ #609 Nombre de hardware: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF /iF, BIOS 3.0 26/07/2013 Seguimiento de llamadas: dump_stack_lvl+0x32/0x50 print_report+0xca/0x620 kasan_report_invalid_free+0x64/0x90 __kasan_slab_free+0x1aa/0x1f0 kfree+0xed/0x2e0 inet_sock_destruct+0x 54f/0x8b0 __sk_destruct+0x48/ 0x5b0 rcu_do_batch+0x34e/0xd90 rcu_core+0x559/0xac0 __do_softirq+0x183/0x5a4 irq_exit_rcu+0x12d/0x170 sysvec_apic_timer_interrupt+0x6b/0x80 asm_sysvec_apic _timer_interrupt+0x16/0x20 RIP: 0010:cpuidle_enter_state+0x175/0x300 C\u00f3digo: 30 00 0f 84 1f 01 00 00 83 e8 01 83 f8 ff 75 e5 48 83 c4 18 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc fb 45 85 ed \u0026lt;0f\u0026gt; 89 60 ff ff ff 48 c1 e5 06 48 c7 43 18 00 00 00 00 48 83 44 2b RSP: 0018:ffff888481cf7d90 EFLAGS: 00000202 RAX: 00000000000000000 RBX: ffff88887facddc8 RCX: 00000 00000000000 RDX: 1ffff1110ff588b1 RSI: 0000000000000019 RDI: ffff88887fac4588 RBP: 00000000000000004 R08: 0000000000000002 R09: 0000000000043 080 R10: 0009b02ea273363f R11: ffff88887fabf42b R12: ffffffff932592e0 R13: 0000000000000004 R14: 00000000000000000 R15: 00000022c880ec80 cpuidle_enter+ 0x4a/0xa0 do_idle+0x310/0x410 cpu_startup_entry+0x51/0x60 start_secondary+0x211/0x270 second_startup_64_no_verify+0x184/0x18b Asignado por tarea 6853: kasan_save_stack+0x1c/0x40 kasan_save_track+0x10/0x30 __kasan_kmalloc+0xa6/0xb0 __kmalloc+0x1eb/0x450 cipso_v4_sock_setattr+0x96/0x360 netlbl_sock_setattr+0x132/0x1f0 selinux_net lbl_socket_post_create+0x6c/0x110 selinux_socket_post_create+0x37b/0x7f0 seguridad_socket_post_create+0x63/0xb0 __sock_create+0x305 /0x450 __sys_socket_create.part.23+0xbd/0x130 __sys_socket+0x37/0xb0 __x64_sys_socket+0x6f/0xb0 do_syscall_64+0x83/0x160 Entry_SYSCALL_64_after_hwframe+0x6e/0x76 Liberado por la tarea 68 58: kasan_save_stack+0x1c/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x3b/ 0x60 __kasan_slab_free+0x12c/0x1f0 kfree+0xed/0x2e0 inet_sock_destruct+0x54f/0x8b0 __sk_destruct+0x48/0x5b0 subflow_ulp_release+0x1f0/0x250 tcp_cleanup_ulp+0x6e/0x110 tcp_v4_destroy _sock+0x5a/0x3a0 inet_csk_destroy_sock+0x135/0x390 tcp_fin+0x416/0x5c0 tcp_data_queue+0x1bc8/ 0x4310 tcp_rcv_state_process+0x15a3/0x47b0 tcp_v4_do_rcv+0x2c1/0x990 tcp_v4_rcv+0x41fb/0x5ed0 ip_protocol_deliver_rcu+0x6d/0x9f0 ip_local_deliver_finish+0x278/0x360 ip_ local_deliver+0x182/0x2c0 ip_rcv+0xb5/0x1c0 __netif_receive_skb_one_core+0x16e/0x1b0 Process_backlog+0x1e3/0x650 __napi_poll+0xa6/ 0x500 net_rx_action+0x740/0xbb0 __do_softirq+0x183/0x5a4 La direcci\u00f3n con errores pertenece al objeto en ffff888485950880 que pertenece al cach\u00e9 kmalloc-64 de tama\u00f1o 64. La direcci\u00f3n con errores se encuentra a 0 bytes dentro de la regi\u00f3n de 64 bytes [ffff888485950880, ffff88848 59508c0) El La direcci\u00f3n con errores pertenece a la p\u00e1gina f\u00edsica: p\u00e1gina:0000000056d1e95e refcount:1 mapcount:0 mapeo:0000000000000000 \u00edndice:0xffff888485950700 pfn:0x485950 banderas: 0x57ffffc0000800(slab|node=1|zone=2|lastcpupid=0x1f ffff) tipo_p\u00e1gina: 0xffffffff() sin procesar : 0057ffffc0000800 ffff88810004c640 ffffea00121b8ac0 dead000000000006 raw: ffff888485950700 0000000000200019 00000001ffffffff 0000000000000000 p\u00e1gina volcada porque: kasan: se detect\u00f3 mal acceso Estado de la memoria alrededor de la direcci\u00f3n con errores: ffff888485950780: fa fb fb ---truncado---\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-415\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.6\",\"versionEndExcluding\":\"5.10.212\",\"matchCriteriaId\":\"1DCB3708-5DB7-49ED-84B1-DA0C5BF4659A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.151\",\"matchCriteriaId\":\"EEAFD33E-C22F-4FB1-A417-9C96AB3E0358\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.81\",\"matchCriteriaId\":\"EC825B0E-DFCA-4034-9B92-F111A4E2A732\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.21\",\"matchCriteriaId\":\"B19074A2-9FE5-4E7D-9E2D-020F95013ADA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.9\",\"matchCriteriaId\":\"1C538467-EDA0-4A9A-82EB-2925DE9FF827\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"A780F817-2A77-4130-A9B7-5C25606314E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"AEB9199B-AB8F-4877-8964-E2BA95B5F15C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/10048689def7e40a4405acda16fdc6477d4ecc5c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4a4eeb6912538c2d0b158e8d11b62d96c1dada4e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/85933e80d077c9ae2227226beb86c22f464059cc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ce0809ada38dca8d6d41bb57ab40494855c30582\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d93fd40c62397326046902a2c5cb75af50882a85\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f74362a004225df935863dea6eb7d82daaa5b16e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/10048689def7e40a4405acda16fdc6477d4ecc5c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4a4eeb6912538c2d0b158e8d11b62d96c1dada4e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/85933e80d077c9ae2227226beb86c22f464059cc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ce0809ada38dca8d6d41bb57ab40494855c30582\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d93fd40c62397326046902a2c5cb75af50882a85\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f74362a004225df935863dea6eb7d82daaa5b16e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f74362a004225df935863dea6eb7d82daaa5b16e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4a4eeb6912538c2d0b158e8d11b62d96c1dada4e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d93fd40c62397326046902a2c5cb75af50882a85\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ce0809ada38dca8d6d41bb57ab40494855c30582\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/85933e80d077c9ae2227226beb86c22f464059cc\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/10048689def7e40a4405acda16fdc6477d4ecc5c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.370Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26782\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:51:05.325955Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:19.282Z\"}}], \"cna\": {\"title\": \"mptcp: fix double-free on socket dismantle\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be\", \"lessThan\": \"f74362a004225df935863dea6eb7d82daaa5b16e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be\", \"lessThan\": \"4a4eeb6912538c2d0b158e8d11b62d96c1dada4e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be\", \"lessThan\": \"d93fd40c62397326046902a2c5cb75af50882a85\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be\", \"lessThan\": \"ce0809ada38dca8d6d41bb57ab40494855c30582\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be\", \"lessThan\": \"85933e80d077c9ae2227226beb86c22f464059cc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be\", \"lessThan\": \"10048689def7e40a4405acda16fdc6477d4ecc5c\", \"versionType\": \"git\"}], \"programFiles\": [\"net/mptcp/protocol.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.212\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.151\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.81\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.21\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/mptcp/protocol.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f74362a004225df935863dea6eb7d82daaa5b16e\"}, {\"url\": \"https://git.kernel.org/stable/c/4a4eeb6912538c2d0b158e8d11b62d96c1dada4e\"}, {\"url\": \"https://git.kernel.org/stable/c/d93fd40c62397326046902a2c5cb75af50882a85\"}, {\"url\": \"https://git.kernel.org/stable/c/ce0809ada38dca8d6d41bb57ab40494855c30582\"}, {\"url\": \"https://git.kernel.org/stable/c/85933e80d077c9ae2227226beb86c22f464059cc\"}, {\"url\": \"https://git.kernel.org/stable/c/10048689def7e40a4405acda16fdc6477d4ecc5c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmptcp: fix double-free on socket dismantle\\n\\nwhen MPTCP server accepts an incoming connection, it clones its listener\\nsocket. However, the pointer to \u0027inet_opt\u0027 for the new socket has the same\\nvalue as the original one: as a consequence, on program exit it\u0027s possible\\nto observe the following splat:\\n\\n BUG: KASAN: double-free in inet_sock_destruct+0x54f/0x8b0\\n Free of addr ffff888485950880 by task swapper/25/0\\n\\n CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Not tainted 6.8.0-rc1+ #609\\n Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0 07/26/2013\\n Call Trace:\\n \u003cIRQ\u003e\\n dump_stack_lvl+0x32/0x50\\n print_report+0xca/0x620\\n kasan_report_invalid_free+0x64/0x90\\n __kasan_slab_free+0x1aa/0x1f0\\n kfree+0xed/0x2e0\\n inet_sock_destruct+0x54f/0x8b0\\n __sk_destruct+0x48/0x5b0\\n rcu_do_batch+0x34e/0xd90\\n rcu_core+0x559/0xac0\\n __do_softirq+0x183/0x5a4\\n irq_exit_rcu+0x12d/0x170\\n sysvec_apic_timer_interrupt+0x6b/0x80\\n \u003c/IRQ\u003e\\n \u003cTASK\u003e\\n asm_sysvec_apic_timer_interrupt+0x16/0x20\\n RIP: 0010:cpuidle_enter_state+0x175/0x300\\n Code: 30 00 0f 84 1f 01 00 00 83 e8 01 83 f8 ff 75 e5 48 83 c4 18 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc fb 45 85 ed \u003c0f\u003e 89 60 ff ff ff 48 c1 e5 06 48 c7 43 18 00 00 00 00 48 83 44 2b\\n RSP: 0018:ffff888481cf7d90 EFLAGS: 00000202\\n RAX: 0000000000000000 RBX: ffff88887facddc8 RCX: 0000000000000000\\n RDX: 1ffff1110ff588b1 RSI: 0000000000000019 RDI: ffff88887fac4588\\n RBP: 0000000000000004 R08: 0000000000000002 R09: 0000000000043080\\n R10: 0009b02ea273363f R11: ffff88887fabf42b R12: ffffffff932592e0\\n R13: 0000000000000004 R14: 0000000000000000 R15: 00000022c880ec80\\n cpuidle_enter+0x4a/0xa0\\n do_idle+0x310/0x410\\n cpu_startup_entry+0x51/0x60\\n start_secondary+0x211/0x270\\n secondary_startup_64_no_verify+0x184/0x18b\\n \u003c/TASK\u003e\\n\\n Allocated by task 6853:\\n kasan_save_stack+0x1c/0x40\\n kasan_save_track+0x10/0x30\\n __kasan_kmalloc+0xa6/0xb0\\n __kmalloc+0x1eb/0x450\\n cipso_v4_sock_setattr+0x96/0x360\\n netlbl_sock_setattr+0x132/0x1f0\\n selinux_netlbl_socket_post_create+0x6c/0x110\\n selinux_socket_post_create+0x37b/0x7f0\\n security_socket_post_create+0x63/0xb0\\n __sock_create+0x305/0x450\\n __sys_socket_create.part.23+0xbd/0x130\\n __sys_socket+0x37/0xb0\\n __x64_sys_socket+0x6f/0xb0\\n do_syscall_64+0x83/0x160\\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\\n\\n Freed by task 6858:\\n kasan_save_stack+0x1c/0x40\\n kasan_save_track+0x10/0x30\\n kasan_save_free_info+0x3b/0x60\\n __kasan_slab_free+0x12c/0x1f0\\n kfree+0xed/0x2e0\\n inet_sock_destruct+0x54f/0x8b0\\n __sk_destruct+0x48/0x5b0\\n subflow_ulp_release+0x1f0/0x250\\n tcp_cleanup_ulp+0x6e/0x110\\n tcp_v4_destroy_sock+0x5a/0x3a0\\n inet_csk_destroy_sock+0x135/0x390\\n tcp_fin+0x416/0x5c0\\n tcp_data_queue+0x1bc8/0x4310\\n tcp_rcv_state_process+0x15a3/0x47b0\\n tcp_v4_do_rcv+0x2c1/0x990\\n tcp_v4_rcv+0x41fb/0x5ed0\\n ip_protocol_deliver_rcu+0x6d/0x9f0\\n ip_local_deliver_finish+0x278/0x360\\n ip_local_deliver+0x182/0x2c0\\n ip_rcv+0xb5/0x1c0\\n __netif_receive_skb_one_core+0x16e/0x1b0\\n process_backlog+0x1e3/0x650\\n __napi_poll+0xa6/0x500\\n net_rx_action+0x740/0xbb0\\n __do_softirq+0x183/0x5a4\\n\\n The buggy address belongs to the object at ffff888485950880\\n which belongs to the cache kmalloc-64 of size 64\\n The buggy address is located 0 bytes inside of\\n 64-byte region [ffff888485950880, ffff8884859508c0)\\n\\n The buggy address belongs to the physical page:\\n page:0000000056d1e95e refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888485950700 pfn:0x485950\\n flags: 0x57ffffc0000800(slab|node=1|zone=2|lastcpupid=0x1fffff)\\n page_type: 0xffffffff()\\n raw: 0057ffffc0000800 ffff88810004c640 ffffea00121b8ac0 dead000000000006\\n raw: ffff888485950700 0000000000200019 00000001ffffffff 0000000000000000\\n page dumped because: kasan: bad access detected\\n\\n Memory state around the buggy address:\\n ffff888485950780: fa fb fb\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.212\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.151\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.81\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.21\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.9\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"5.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:04:04.888Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-26782\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:04:04.888Z\", \"dateReserved\": \"2024-02-19T14:20:24.177Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-04T08:20:16.472Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…