{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:07:19.745Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d2f1b7fe74afd66298dbb3c7b39e7b62e4df1724"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dcaafdba6c6162bb49f1192850bc3bbc3707738c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2e8c9ae40adda2be1ba41c05fd3cd1e61cce3207"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e622502c310f1069fd9f41cd38210553115f610a"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26626",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:55:51.122168Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:30.184Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip.h",
            "net/ipv4/ip_sockglue.c",
            "net/ipv4/ipmr.c",
            "net/ipv4/raw.c",
            "net/ipv4/udp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d2f1b7fe74afd66298dbb3c7b39e7b62e4df1724",
              "status": "affected",
              "version": "f69365e3a7cab819099249c50b39f4450fdddc60",
              "versionType": "git"
            },
            {
              "lessThan": "dcaafdba6c6162bb49f1192850bc3bbc3707738c",
              "status": "affected",
              "version": "7b32e63f881432bf30f282328b8e64c6aa494ba2",
              "versionType": "git"
            },
            {
              "lessThan": "2e8c9ae40adda2be1ba41c05fd3cd1e61cce3207",
              "status": "affected",
              "version": "7d97858e21fbc472acda7d908357c5fe54a8e439",
              "versionType": "git"
            },
            {
              "lessThan": "e622502c310f1069fd9f41cd38210553115f610a",
              "status": "affected",
              "version": "bb7403655b3c3eb245d0ee330047cd3e20b3c4af",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip.h",
            "net/ipv4/ip_sockglue.c",
            "net/ipv4/ipmr.c",
            "net/ipv4/raw.c",
            "net/ipv4/udp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.1.77",
              "status": "affected",
              "version": "6.1.75",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.16",
              "status": "affected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7.4",
              "status": "affected",
              "version": "6.7.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.77",
                  "versionStartIncluding": "6.1.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.16",
                  "versionStartIncluding": "6.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.4",
                  "versionStartIncluding": "6.7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmr: fix kernel panic when forwarding mcast packets\n\nThe stacktrace was:\n[   86.305548] BUG: kernel NULL pointer dereference, address: 0000000000000092\n[   86.306815] #PF: supervisor read access in kernel mode\n[   86.307717] #PF: error_code(0x0000) - not-present page\n[   86.308624] PGD 0 P4D 0\n[   86.309091] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[   86.309883] CPU: 2 PID: 3139 Comm: pimd Tainted: G     U             6.8.0-6wind-knet #1\n[   86.311027] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.1-0-g0551a4be2c-prebuilt.qemu-project.org 04/01/2014\n[   86.312728] RIP: 0010:ip_mr_forward (/build/work/knet/net/ipv4/ipmr.c:1985)\n[ 86.313399] Code: f9 1f 0f 87 85 03 00 00 48 8d 04 5b 48 8d 04 83 49 8d 44 c5 00 48 8b 40 70 48 39 c2 0f 84 d9 00 00 00 49 8b 46 58 48 83 e0 fe \u003c80\u003e b8 92 00 00 00 00 0f 84 55 ff ff ff 49 83 47 38 01 45 85 e4 0f\n[   86.316565] RSP: 0018:ffffad21c0583ae0 EFLAGS: 00010246\n[   86.317497] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n[   86.318596] RDX: ffff9559cb46c000 RSI: 0000000000000000 RDI: 0000000000000000\n[   86.319627] RBP: ffffad21c0583b30 R08: 0000000000000000 R09: 0000000000000000\n[   86.320650] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001\n[   86.321672] R13: ffff9559c093a000 R14: ffff9559cc00b800 R15: ffff9559c09c1d80\n[   86.322873] FS:  00007f85db661980(0000) GS:ffff955a79d00000(0000) knlGS:0000000000000000\n[   86.324291] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   86.325314] CR2: 0000000000000092 CR3: 000000002f13a000 CR4: 0000000000350ef0\n[   86.326589] Call Trace:\n[   86.327036]  \u003cTASK\u003e\n[   86.327434] ? show_regs (/build/work/knet/arch/x86/kernel/dumpstack.c:479)\n[   86.328049] ? __die (/build/work/knet/arch/x86/kernel/dumpstack.c:421 /build/work/knet/arch/x86/kernel/dumpstack.c:434)\n[   86.328508] ? page_fault_oops (/build/work/knet/arch/x86/mm/fault.c:707)\n[   86.329107] ? do_user_addr_fault (/build/work/knet/arch/x86/mm/fault.c:1264)\n[   86.329756] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223)\n[   86.330350] ? __irq_work_queue_local (/build/work/knet/kernel/irq_work.c:111 (discriminator 1))\n[   86.331013] ? exc_page_fault (/build/work/knet/./arch/x86/include/asm/paravirt.h:693 /build/work/knet/arch/x86/mm/fault.c:1515 /build/work/knet/arch/x86/mm/fault.c:1563)\n[   86.331702] ? asm_exc_page_fault (/build/work/knet/./arch/x86/include/asm/idtentry.h:570)\n[   86.332468] ? ip_mr_forward (/build/work/knet/net/ipv4/ipmr.c:1985)\n[   86.333183] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223)\n[   86.333920] ipmr_mfc_add (/build/work/knet/./include/linux/rcupdate.h:782 /build/work/knet/net/ipv4/ipmr.c:1009 /build/work/knet/net/ipv4/ipmr.c:1273)\n[   86.334583] ? __pfx_ipmr_hash_cmp (/build/work/knet/net/ipv4/ipmr.c:363)\n[   86.335357] ip_mroute_setsockopt (/build/work/knet/net/ipv4/ipmr.c:1470)\n[   86.336135] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223)\n[   86.336854] ? ip_mroute_setsockopt (/build/work/knet/net/ipv4/ipmr.c:1470)\n[   86.337679] do_ip_setsockopt (/build/work/knet/net/ipv4/ip_sockglue.c:944)\n[   86.338408] ? __pfx_unix_stream_read_actor (/build/work/knet/net/unix/af_unix.c:2862)\n[   86.339232] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223)\n[   86.339809] ? aa_sk_perm (/build/work/knet/security/apparmor/include/cred.h:153 /build/work/knet/security/apparmor/net.c:181)\n[   86.340342] ip_setsockopt (/build/work/knet/net/ipv4/ip_sockglue.c:1415)\n[   86.340859] raw_setsockopt (/build/work/knet/net/ipv4/raw.c:836)\n[   86.341408] ? security_socket_setsockopt (/build/work/knet/security/security.c:4561 (discriminator 13))\n[   86.342116] sock_common_setsockopt (/build/work/knet/net/core/sock.c:3716)\n[   86.342747] do_sock_setsockopt (/build/work/knet/net/socket.c:2313)\n[   86.343363] __sys_setsockopt (/build/work/knet/./include/linux/file.h:32 /build/work/kn\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable state is created by a multicast IP packet received from the network \u2014 `ip_mr_input()` \u2192 `ipmr_cache_unresolved()` \u2192 `ipmr_cache_report()` strips the dst from the received skb before queuing it. Multicast traffic reaches a multicast router from arbitrary distances via PIM/MSDP and routed multicast, so the attacker need not be on the same L2 segment.\nAC:L - `skb_dst_drop()` in `ipv4_pktinfo_prepare()` is unconditional, so every packet queued for cache resolution deterministically loses its dst and the next MFC install oopses; there is no race, no memory-layout dependency, and no socket-option precondition. The multicast routing daemon installing the route in response to the IGMPMSG_NOCACHE upcall is the router\u0027s normal, automatic behavior.\nPR:N - A remote attacker only has to emit an unauthenticated multicast datagram for an (S,G) with no existing MFC entry; no credentials or session are needed. Even the purely local trigger requires only namespaced CAP_NET_ADMIN/CAP_NET_RAW obtainable by any unprivileged user via `unshare -Urn`, since `ip_mroute_setsockopt()` uses `ns_capable(net-\u003euser_ns, CAP_NET_ADMIN)`.\nUI:N - The multicast routing daemon adds the MFC entry automatically as part of its normal packet-driven operation, with no human involvement. No victim action such as mounting a filesystem or opening a file is required.\nS:U - The NULL dereference and the resulting oops occur inside the kernel that owns the affected multicast routing state, with no crossing into another security authority. There is no hypervisor, IOMMU, or sandbox boundary involved.\nC:N - The fault is a read of `rt-\u003ert_is_input` at the fixed unmapped address NULL+0x92 in `rt_is_output_route()`, which faults before any value is produced. No kernel memory contents are returned to or observable by the attacker.\nI:N - The bug is a read-only dereference of a NULL `skb_dst()`; no memory is written and no attacker-controlled pointer or length is involved. There is no corruption primitive to leverage for control-flow hijacking.\nA:H - The dereference produces a kernel oops/panic in `ip_mr_forward()`, and it happens with `rtnl_lock()` held and under `rcu_read_lock()`, so even absent `panic_on_oops` the dying task leaks RTNL and permanently deadlocks all subsequent network configuration. This is a complete, repeatable denial of service on a multicast router."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:26:22.586Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d2f1b7fe74afd66298dbb3c7b39e7b62e4df1724"
        },
        {
          "url": "https://git.kernel.org/stable/c/dcaafdba6c6162bb49f1192850bc3bbc3707738c"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e8c9ae40adda2be1ba41c05fd3cd1e61cce3207"
        },
        {
          "url": "https://git.kernel.org/stable/c/e622502c310f1069fd9f41cd38210553115f610a"
        }
      ],
      "title": "ipmr: fix kernel panic when forwarding mcast packets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26626",
    "datePublished": "2024-03-06T06:45:33.826Z",
    "dateReserved": "2024-02-19T14:20:24.135Z",
    "dateUpdated": "2026-08-05T11:26:22.586Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}