GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-26635 (GCVE-0-2024-26635)

Vulnerability from cvelistv5 – Published: 2024-03-18 10:14 – Updated: 2026-05-11 20:01
VLAI
Title
llc: Drop support for ETH_P_TR_802_2.
Summary
In the Linux kernel, the following vulnerability has been resolved: llc: Drop support for ETH_P_TR_802_2. syzbot reported an uninit-value bug below. [0] llc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2 (0x0011), and syzbot abused the latter to trigger the bug. write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, ')', "90e5dd"}}}}, 0x16) llc_conn_handler() initialises local variables {saddr,daddr}.mac based on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passes them to __llc_lookup(). However, the initialisation is done only when skb->protocol is htons(ETH_P_802_2), otherwise, __llc_lookup_established() and __llc_lookup_listener() will read garbage. The missing initialisation existed prior to commit 211ed865108e ("net: delete all instances of special processing for token ring"). It removed the part to kick out the token ring stuff but forgot to close the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv(). Let's remove llc_tr_packet_type and complete the deprecation. [0]: BUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90 __llc_lookup_established+0xe9d/0xf90 __llc_lookup net/llc/llc_conn.c:611 [inline] llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:791 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 __netif_receive_skb_one_core net/core/dev.c:5527 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641 netif_receive_skb_internal net/core/dev.c:5727 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5786 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555 tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2020 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x1490 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Local variable daddr created at: llc_conn_handler+0x53/0x1360 net/llc/llc_conn.c:783 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 CPU: 1 PID: 5004 Comm: syz-executor994 Not tainted 6.6.0-syzkaller-14500-g1c41041124bd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:55 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 211ed865108e24697b44bee5daac502ee6bdd4a4 , < 165ad1e22779685c3ed3dd349c6c4c632309cc62 (git)
Affected: 211ed865108e24697b44bee5daac502ee6bdd4a4 , < b8e8838f82f332ae80c643dbb1ca4418d0628097 (git)
Affected: 211ed865108e24697b44bee5daac502ee6bdd4a4 , < 9ccdef19cf9497c2803b005369668feb91cacdfd (git)
Affected: 211ed865108e24697b44bee5daac502ee6bdd4a4 , < c0fe2fe7a5a291dfcf6dc64301732c8d3dc6a828 (git)
Affected: 211ed865108e24697b44bee5daac502ee6bdd4a4 , < 660c3053d992b68fee893a0e9ec9159228cffdc6 (git)
Affected: 211ed865108e24697b44bee5daac502ee6bdd4a4 , < f1f34a515fb1e25e85dee94f781e7869ae351fb8 (git)
Affected: 211ed865108e24697b44bee5daac502ee6bdd4a4 , < df57fc2f2abf548aa889a36ab0bdcc94a75399dc (git)
Affected: 211ed865108e24697b44bee5daac502ee6bdd4a4 , < e3f9bed9bee261e3347131764e42aeedf1ffea61 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.5
Unaffected: 0 , < 3.5 (semver)
Unaffected: 4.19.307 , ≤ 4.19.* (semver)
Unaffected: 5.4.269 , ≤ 5.4.* (semver)
Unaffected: 5.10.210 , ≤ 5.10.* (semver)
Unaffected: 5.15.149 , ≤ 5.15.* (semver)
Unaffected: 6.1.76 , ≤ 6.1.* (semver)
Unaffected: 6.6.15 , ≤ 6.6.* (semver)
Unaffected: 6.7.3 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:07:19.852Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/165ad1e22779685c3ed3dd349c6c4c632309cc62"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b8e8838f82f332ae80c643dbb1ca4418d0628097"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9ccdef19cf9497c2803b005369668feb91cacdfd"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c0fe2fe7a5a291dfcf6dc64301732c8d3dc6a828"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/660c3053d992b68fee893a0e9ec9159228cffdc6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f1f34a515fb1e25e85dee94f781e7869ae351fb8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/df57fc2f2abf548aa889a36ab0bdcc94a75399dc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e3f9bed9bee261e3347131764e42aeedf1ffea61"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26635",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:55:09.935989Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:17.228Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/llc_pdu.h",
            "net/llc/llc_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "165ad1e22779685c3ed3dd349c6c4c632309cc62",
              "status": "affected",
              "version": "211ed865108e24697b44bee5daac502ee6bdd4a4",
              "versionType": "git"
            },
            {
              "lessThan": "b8e8838f82f332ae80c643dbb1ca4418d0628097",
              "status": "affected",
              "version": "211ed865108e24697b44bee5daac502ee6bdd4a4",
              "versionType": "git"
            },
            {
              "lessThan": "9ccdef19cf9497c2803b005369668feb91cacdfd",
              "status": "affected",
              "version": "211ed865108e24697b44bee5daac502ee6bdd4a4",
              "versionType": "git"
            },
            {
              "lessThan": "c0fe2fe7a5a291dfcf6dc64301732c8d3dc6a828",
              "status": "affected",
              "version": "211ed865108e24697b44bee5daac502ee6bdd4a4",
              "versionType": "git"
            },
            {
              "lessThan": "660c3053d992b68fee893a0e9ec9159228cffdc6",
              "status": "affected",
              "version": "211ed865108e24697b44bee5daac502ee6bdd4a4",
              "versionType": "git"
            },
            {
              "lessThan": "f1f34a515fb1e25e85dee94f781e7869ae351fb8",
              "status": "affected",
              "version": "211ed865108e24697b44bee5daac502ee6bdd4a4",
              "versionType": "git"
            },
            {
              "lessThan": "df57fc2f2abf548aa889a36ab0bdcc94a75399dc",
              "status": "affected",
              "version": "211ed865108e24697b44bee5daac502ee6bdd4a4",
              "versionType": "git"
            },
            {
              "lessThan": "e3f9bed9bee261e3347131764e42aeedf1ffea61",
              "status": "affected",
              "version": "211ed865108e24697b44bee5daac502ee6bdd4a4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/llc_pdu.h",
            "net/llc/llc_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.5"
            },
            {
              "lessThan": "3.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.307",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.269",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.76",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.307",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.269",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.210",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.149",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.76",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.15",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.3",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nllc: Drop support for ETH_P_TR_802_2.\n\nsyzbot reported an uninit-value bug below. [0]\n\nllc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2\n(0x0011), and syzbot abused the latter to trigger the bug.\n\n  write$tun(r0, \u0026(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, \u0027)\u0027, \"90e5dd\"}}}}, 0x16)\n\nllc_conn_handler() initialises local variables {saddr,daddr}.mac\nbased on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passes\nthem to __llc_lookup().\n\nHowever, the initialisation is done only when skb-\u003eprotocol is\nhtons(ETH_P_802_2), otherwise, __llc_lookup_established() and\n__llc_lookup_listener() will read garbage.\n\nThe missing initialisation existed prior to commit 211ed865108e\n(\"net: delete all instances of special processing for token ring\").\n\nIt removed the part to kick out the token ring stuff but forgot to\nclose the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv().\n\nLet\u0027s remove llc_tr_packet_type and complete the deprecation.\n\n[0]:\nBUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90\n __llc_lookup_established+0xe9d/0xf90\n __llc_lookup net/llc/llc_conn.c:611 [inline]\n llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:791\n llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206\n __netif_receive_skb_one_core net/core/dev.c:5527 [inline]\n __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641\n netif_receive_skb_internal net/core/dev.c:5727 [inline]\n netif_receive_skb+0x58/0x660 net/core/dev.c:5786\n tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555\n tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002\n tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n call_write_iter include/linux/fs.h:2020 [inline]\n new_sync_write fs/read_write.c:491 [inline]\n vfs_write+0x8ef/0x1490 fs/read_write.c:584\n ksys_write+0x20f/0x4c0 fs/read_write.c:637\n __do_sys_write fs/read_write.c:649 [inline]\n __se_sys_write fs/read_write.c:646 [inline]\n __x64_sys_write+0x93/0xd0 fs/read_write.c:646\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nLocal variable daddr created at:\n llc_conn_handler+0x53/0x1360 net/llc/llc_conn.c:783\n llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206\n\nCPU: 1 PID: 5004 Comm: syz-executor994 Not tainted 6.6.0-syzkaller-14500-g1c41041124bd #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:01:13.758Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/165ad1e22779685c3ed3dd349c6c4c632309cc62"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8e8838f82f332ae80c643dbb1ca4418d0628097"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ccdef19cf9497c2803b005369668feb91cacdfd"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0fe2fe7a5a291dfcf6dc64301732c8d3dc6a828"
        },
        {
          "url": "https://git.kernel.org/stable/c/660c3053d992b68fee893a0e9ec9159228cffdc6"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1f34a515fb1e25e85dee94f781e7869ae351fb8"
        },
        {
          "url": "https://git.kernel.org/stable/c/df57fc2f2abf548aa889a36ab0bdcc94a75399dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3f9bed9bee261e3347131764e42aeedf1ffea61"
        }
      ],
      "title": "llc: Drop support for ETH_P_TR_802_2.",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26635",
    "datePublished": "2024-03-18T10:14:47.213Z",
    "dateReserved": "2024-02-19T14:20:24.136Z",
    "dateUpdated": "2026-05-11T20:01:13.758Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26635",
      "date": "2026-09-16",
      "epss": "0.00242",
      "percentile": "0.1556"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nllc: Drop support for ETH_P_TR_802_2.\\n\\nsyzbot reported an uninit-value bug below. [0]\\n\\nllc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2\\n(0x0011), and syzbot abused the latter to trigger the bug.\\n\\n  write$tun(r0, \u0026(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, \u0027)\u0027, \\\"90e5dd\\\"}}}}, 0x16)\\n\\nllc_conn_handler() initialises local variables {saddr,daddr}.mac\\nbased on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passes\\nthem to __llc_lookup().\\n\\nHowever, the initialisation is done only when skb-\u003eprotocol is\\nhtons(ETH_P_802_2), otherwise, __llc_lookup_established() and\\n__llc_lookup_listener() will read garbage.\\n\\nThe missing initialisation existed prior to commit 211ed865108e\\n(\\\"net: delete all instances of special processing for token ring\\\").\\n\\nIt removed the part to kick out the token ring stuff but forgot to\\nclose the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv().\\n\\nLet\u0027s remove llc_tr_packet_type and complete the deprecation.\\n\\n[0]:\\nBUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90\\n __llc_lookup_established+0xe9d/0xf90\\n __llc_lookup net/llc/llc_conn.c:611 [inline]\\n llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:791\\n llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206\\n __netif_receive_skb_one_core net/core/dev.c:5527 [inline]\\n __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641\\n netif_receive_skb_internal net/core/dev.c:5727 [inline]\\n netif_receive_skb+0x58/0x660 net/core/dev.c:5786\\n tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555\\n tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002\\n tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\\n call_write_iter include/linux/fs.h:2020 [inline]\\n new_sync_write fs/read_write.c:491 [inline]\\n vfs_write+0x8ef/0x1490 fs/read_write.c:584\\n ksys_write+0x20f/0x4c0 fs/read_write.c:637\\n __do_sys_write fs/read_write.c:649 [inline]\\n __se_sys_write fs/read_write.c:646 [inline]\\n __x64_sys_write+0x93/0xd0 fs/read_write.c:646\\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82\\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\\n\\nLocal variable daddr created at:\\n llc_conn_handler+0x53/0x1360 net/llc/llc_conn.c:783\\n llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206\\n\\nCPU: 1 PID: 5004 Comm: syz-executor994 Not tainted 6.6.0-syzkaller-14500-g1c41041124bd #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: llc: Eliminaci\\u00f3n del soporte para ETH_P_TR_802_2. syzbot inform\\u00f3 un error de valor uninit a continuaci\\u00f3n. [0] llc admite ETH_P_802_2 (0x0004) y sol\\u00eda admitir ETH_P_TR_802_2 (0x0011), y syzbot abus\\u00f3 de este \\u00faltimo para desencadenar el error. escribir$tun(r0, \u0026amp;(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, \u0027)\u0027, \\\"90e5dd\\\" }}}}, 0x16) llc_conn_handler() inicializa las variables locales {saddr,daddr}.mac basadas en skb en llc_pdu_decode_sa()/llc_pdu_decode_da() y las pasa a __llc_lookup(). Sin embargo, la inicializaci\\u00f3n se realiza solo cuando skb-\u0026gt;protocol es htons(ETH_P_802_2); de lo contrario, __llc_lookup_establecido() y __llc_lookup_listener() leer\\u00e1n basura. La inicializaci\\u00f3n faltante exist\\u00eda antes de el commit 211ed865108e (\\\"net: eliminar todas las instancias de procesamiento especial para Token Ring\\\"). Quit\\u00f3 la parte para expulsar el token ring, pero se olvid\\u00f3 de cerrar la puerta permitiendo que los paquetes ETH_P_TR_802_2 se colaran en llc_rcv(). Eliminemos llc_tr_packet_type y completemos la desaprobaci\\u00f3n. [0]: ERROR: KMSAN: valor uninit en __llc_lookup_establecido+0xe9d/0xf90 __llc_lookup_establecido+0xe9d/0xf90 __llc_lookup net/llc/llc_conn.c:611 [en l\\u00ednea] llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:79 1 llc_rcv +0xfbb/0x14a0 net/llc/llc_input.c:206 __netif_receive_skb_one_core net/core/dev.c:5527 [en l\\u00ednea] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641 netif_receive_skb_internal net/core/dev.c:5727 [en l\\u00ednea] netif_receive_skb+0x58/0x660 net/core/dev.c:5786 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555 tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2020 [en l\\u00ednea] new_sync_write fs/read_write.c:491 [en l\\u00ednea] vfs_write+0x8ef/0x1490 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [en l\\u00ednea] __se_sys_write fs/read_write.c:646 [en l\\u00ednea] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common. c: 51 [en l\\u00ednea] do_syscall_64+0x44/0x110 arch/x86/entry/comunes.c: 82 entry_syscall_64_after_hwframe+0x63/0x6b local variable daddr creado FBB /0x14a0 net/llc/llc_input.c:206 CPU: 1 PID: 5004 Comm: syz-executor994 No contaminado 6.6.0-syzkaller-14500-g1c41041124bd #0 Nombre de hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 10 /09/2023\"}]",
      "id": "CVE-2024-26635",
      "lastModified": "2024-11-21T09:02:44.140",
      "published": "2024-03-18T11:15:10.203",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/165ad1e22779685c3ed3dd349c6c4c632309cc62\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/660c3053d992b68fee893a0e9ec9159228cffdc6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/9ccdef19cf9497c2803b005369668feb91cacdfd\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/b8e8838f82f332ae80c643dbb1ca4418d0628097\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c0fe2fe7a5a291dfcf6dc64301732c8d3dc6a828\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/df57fc2f2abf548aa889a36ab0bdcc94a75399dc\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/e3f9bed9bee261e3347131764e42aeedf1ffea61\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f1f34a515fb1e25e85dee94f781e7869ae351fb8\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/165ad1e22779685c3ed3dd349c6c4c632309cc62\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/660c3053d992b68fee893a0e9ec9159228cffdc6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/9ccdef19cf9497c2803b005369668feb91cacdfd\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/b8e8838f82f332ae80c643dbb1ca4418d0628097\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/c0fe2fe7a5a291dfcf6dc64301732c8d3dc6a828\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/df57fc2f2abf548aa889a36ab0bdcc94a75399dc\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/e3f9bed9bee261e3347131764e42aeedf1ffea61\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/f1f34a515fb1e25e85dee94f781e7869ae351fb8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26635\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-03-18T11:15:10.203\",\"lastModified\":\"2026-06-17T07:17:56.890\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nllc: Drop support for ETH_P_TR_802_2.\\n\\nsyzbot reported an uninit-value bug below. [0]\\n\\nllc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2\\n(0x0011), and syzbot abused the latter to trigger the bug.\\n\\n  write$tun(r0, \u0026(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, \u0027)\u0027, \\\"90e5dd\\\"}}}}, 0x16)\\n\\nllc_conn_handler() initialises local variables {saddr,daddr}.mac\\nbased on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passes\\nthem to __llc_lookup().\\n\\nHowever, the initialisation is done only when skb-\u003eprotocol is\\nhtons(ETH_P_802_2), otherwise, __llc_lookup_established() and\\n__llc_lookup_listener() will read garbage.\\n\\nThe missing initialisation existed prior to commit 211ed865108e\\n(\\\"net: delete all instances of special processing for token ring\\\").\\n\\nIt removed the part to kick out the token ring stuff but forgot to\\nclose the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv().\\n\\nLet\u0027s remove llc_tr_packet_type and complete the deprecation.\\n\\n[0]:\\nBUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90\\n __llc_lookup_established+0xe9d/0xf90\\n __llc_lookup net/llc/llc_conn.c:611 [inline]\\n llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:791\\n llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206\\n __netif_receive_skb_one_core net/core/dev.c:5527 [inline]\\n __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641\\n netif_receive_skb_internal net/core/dev.c:5727 [inline]\\n netif_receive_skb+0x58/0x660 net/core/dev.c:5786\\n tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555\\n tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002\\n tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\\n call_write_iter include/linux/fs.h:2020 [inline]\\n new_sync_write fs/read_write.c:491 [inline]\\n vfs_write+0x8ef/0x1490 fs/read_write.c:584\\n ksys_write+0x20f/0x4c0 fs/read_write.c:637\\n __do_sys_write fs/read_write.c:649 [inline]\\n __se_sys_write fs/read_write.c:646 [inline]\\n __x64_sys_write+0x93/0xd0 fs/read_write.c:646\\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82\\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\\n\\nLocal variable daddr created at:\\n llc_conn_handler+0x53/0x1360 net/llc/llc_conn.c:783\\n llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206\\n\\nCPU: 1 PID: 5004 Comm: syz-executor994 Not tainted 6.6.0-syzkaller-14500-g1c41041124bd #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: llc: Eliminaci\u00f3n del soporte para ETH_P_TR_802_2. syzbot inform\u00f3 un error de valor uninit a continuaci\u00f3n. [0] llc admite ETH_P_802_2 (0x0004) y sol\u00eda admitir ETH_P_TR_802_2 (0x0011), y syzbot abus\u00f3 de este \u00faltimo para desencadenar el error. escribir$tun(r0, \u0026amp;(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, \u0027)\u0027, \\\"90e5dd\\\" }}}}, 0x16) llc_conn_handler() inicializa las variables locales {saddr,daddr}.mac basadas en skb en llc_pdu_decode_sa()/llc_pdu_decode_da() y las pasa a __llc_lookup(). Sin embargo, la inicializaci\u00f3n se realiza solo cuando skb-\u0026gt;protocol es htons(ETH_P_802_2); de lo contrario, __llc_lookup_establecido() y __llc_lookup_listener() leer\u00e1n basura. La inicializaci\u00f3n faltante exist\u00eda antes de el commit 211ed865108e (\\\"net: eliminar todas las instancias de procesamiento especial para Token Ring\\\"). Quit\u00f3 la parte para expulsar el token ring, pero se olvid\u00f3 de cerrar la puerta permitiendo que los paquetes ETH_P_TR_802_2 se colaran en llc_rcv(). Eliminemos llc_tr_packet_type y completemos la desaprobaci\u00f3n. [0]: ERROR: KMSAN: valor uninit en __llc_lookup_establecido+0xe9d/0xf90 __llc_lookup_establecido+0xe9d/0xf90 __llc_lookup net/llc/llc_conn.c:611 [en l\u00ednea] llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:79 1 llc_rcv +0xfbb/0x14a0 net/llc/llc_input.c:206 __netif_receive_skb_one_core net/core/dev.c:5527 [en l\u00ednea] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641 netif_receive_skb_internal net/core/dev.c:5727 [en l\u00ednea] netif_receive_skb+0x58/0x660 net/core/dev.c:5786 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555 tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2020 [en l\u00ednea] new_sync_write fs/read_write.c:491 [en l\u00ednea] vfs_write+0x8ef/0x1490 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [en l\u00ednea] __se_sys_write fs/read_write.c:646 [en l\u00ednea] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common. c: 51 [en l\u00ednea] do_syscall_64+0x44/0x110 arch/x86/entry/comunes.c: 82 entry_syscall_64_after_hwframe+0x63/0x6b local variable daddr creado FBB /0x14a0 net/llc/llc_input.c:206 CPU: 1 PID: 5004 Comm: syz-executor994 No contaminado 6.6.0-syzkaller-14500-g1c41041124bd #0 Nombre de hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 10 /09/2023\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/net/llc_pdu.h\",\"net/llc/llc_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"211ed865108e24697b44bee5daac502ee6bdd4a4\",\"lessThan\":\"165ad1e22779685c3ed3dd349c6c4c632309cc62\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"211ed865108e24697b44bee5daac502ee6bdd4a4\",\"lessThan\":\"b8e8838f82f332ae80c643dbb1ca4418d0628097\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"211ed865108e24697b44bee5daac502ee6bdd4a4\",\"lessThan\":\"9ccdef19cf9497c2803b005369668feb91cacdfd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"211ed865108e24697b44bee5daac502ee6bdd4a4\",\"lessThan\":\"c0fe2fe7a5a291dfcf6dc64301732c8d3dc6a828\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"211ed865108e24697b44bee5daac502ee6bdd4a4\",\"lessThan\":\"660c3053d992b68fee893a0e9ec9159228cffdc6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"211ed865108e24697b44bee5daac502ee6bdd4a4\",\"lessThan\":\"f1f34a515fb1e25e85dee94f781e7869ae351fb8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"211ed865108e24697b44bee5daac502ee6bdd4a4\",\"lessThan\":\"df57fc2f2abf548aa889a36ab0bdcc94a75399dc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"211ed865108e24697b44bee5daac502ee6bdd4a4\",\"lessThan\":\"e3f9bed9bee261e3347131764e42aeedf1ffea61\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/net/llc_pdu.h\",\"net/llc/llc_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.307\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.269\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.210\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.149\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.76\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.15\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.3\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T15:55:09.935989Z\",\"id\":\"CVE-2024-26635\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-909\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.5\",\"versionEndExcluding\":\"4.19.307\",\"matchCriteriaId\":\"36AA7D68-B6BB-4F14-BCB2-4C4FE02838B5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.269\",\"matchCriteriaId\":\"319545F3-D56C-4751-BEBF-0505478BBAE8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.210\",\"matchCriteriaId\":\"F5CB4CA6-A9A0-4AFD-9102-8CF94D708170\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.149\",\"matchCriteriaId\":\"0D0465BB-4053-4E15-9137-6696EBAE90FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.76\",\"matchCriteriaId\":\"32F0FEB3-5FE1-4400-A56D-886F09BE872E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.15\",\"matchCriteriaId\":\"87C718CB-AE3D-4B07-B4D9-BFF64183C468\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.3\",\"matchCriteriaId\":\"58FD5308-148A-40D3-B36A-0CA6B434A8BF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/165ad1e22779685c3ed3dd349c6c4c632309cc62\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/660c3053d992b68fee893a0e9ec9159228cffdc6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9ccdef19cf9497c2803b005369668feb91cacdfd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b8e8838f82f332ae80c643dbb1ca4418d0628097\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c0fe2fe7a5a291dfcf6dc64301732c8d3dc6a828\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/df57fc2f2abf548aa889a36ab0bdcc94a75399dc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e3f9bed9bee261e3347131764e42aeedf1ffea61\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f1f34a515fb1e25e85dee94f781e7869ae351fb8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/165ad1e22779685c3ed3dd349c6c4c632309cc62\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/660c3053d992b68fee893a0e9ec9159228cffdc6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9ccdef19cf9497c2803b005369668feb91cacdfd\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b8e8838f82f332ae80c643dbb1ca4418d0628097\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c0fe2fe7a5a291dfcf6dc64301732c8d3dc6a828\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/df57fc2f2abf548aa889a36ab0bdcc94a75399dc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e3f9bed9bee261e3347131764e42aeedf1ffea61\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f1f34a515fb1e25e85dee94f781e7869ae351fb8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T14:46:10+00:00",
      "cve": "CVE-2024-26635",
      "id": "CVE-2024-26635",
      "initial_release_date": "2024-03-18T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: llc: Drop support for ETH_P_TR_802_2.",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26635.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T13:56:59Z",
      "cve": "CVE-2024-26635",
      "id": "CVE-2024-26635",
      "initial_release_date": "2024-03-20T03:48:18Z",
      "product_status:known_affected": "634",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "735",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26635",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26635.json",
      "version": "79"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/165ad1e22779685c3ed3dd349c6c4c632309cc62\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b8e8838f82f332ae80c643dbb1ca4418d0628097\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9ccdef19cf9497c2803b005369668feb91cacdfd\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c0fe2fe7a5a291dfcf6dc64301732c8d3dc6a828\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/660c3053d992b68fee893a0e9ec9159228cffdc6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f1f34a515fb1e25e85dee94f781e7869ae351fb8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/df57fc2f2abf548aa889a36ab0bdcc94a75399dc\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e3f9bed9bee261e3347131764e42aeedf1ffea61\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:07:19.852Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26635\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:55:09.935989Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:15.929Z\"}}], \"cna\": {\"title\": \"llc: Drop support for ETH_P_TR_802_2.\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"211ed865108e24697b44bee5daac502ee6bdd4a4\", \"lessThan\": \"165ad1e22779685c3ed3dd349c6c4c632309cc62\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"211ed865108e24697b44bee5daac502ee6bdd4a4\", \"lessThan\": \"b8e8838f82f332ae80c643dbb1ca4418d0628097\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"211ed865108e24697b44bee5daac502ee6bdd4a4\", \"lessThan\": \"9ccdef19cf9497c2803b005369668feb91cacdfd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"211ed865108e24697b44bee5daac502ee6bdd4a4\", \"lessThan\": \"c0fe2fe7a5a291dfcf6dc64301732c8d3dc6a828\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"211ed865108e24697b44bee5daac502ee6bdd4a4\", \"lessThan\": \"660c3053d992b68fee893a0e9ec9159228cffdc6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"211ed865108e24697b44bee5daac502ee6bdd4a4\", \"lessThan\": \"f1f34a515fb1e25e85dee94f781e7869ae351fb8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"211ed865108e24697b44bee5daac502ee6bdd4a4\", \"lessThan\": \"df57fc2f2abf548aa889a36ab0bdcc94a75399dc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"211ed865108e24697b44bee5daac502ee6bdd4a4\", \"lessThan\": \"e3f9bed9bee261e3347131764e42aeedf1ffea61\", \"versionType\": \"git\"}], \"programFiles\": [\"include/net/llc_pdu.h\", \"net/llc/llc_core.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.307\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.269\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.210\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.149\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.76\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.15\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/net/llc_pdu.h\", \"net/llc/llc_core.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/165ad1e22779685c3ed3dd349c6c4c632309cc62\"}, {\"url\": \"https://git.kernel.org/stable/c/b8e8838f82f332ae80c643dbb1ca4418d0628097\"}, {\"url\": \"https://git.kernel.org/stable/c/9ccdef19cf9497c2803b005369668feb91cacdfd\"}, {\"url\": \"https://git.kernel.org/stable/c/c0fe2fe7a5a291dfcf6dc64301732c8d3dc6a828\"}, {\"url\": \"https://git.kernel.org/stable/c/660c3053d992b68fee893a0e9ec9159228cffdc6\"}, {\"url\": \"https://git.kernel.org/stable/c/f1f34a515fb1e25e85dee94f781e7869ae351fb8\"}, {\"url\": \"https://git.kernel.org/stable/c/df57fc2f2abf548aa889a36ab0bdcc94a75399dc\"}, {\"url\": \"https://git.kernel.org/stable/c/e3f9bed9bee261e3347131764e42aeedf1ffea61\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nllc: Drop support for ETH_P_TR_802_2.\\n\\nsyzbot reported an uninit-value bug below. [0]\\n\\nllc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2\\n(0x0011), and syzbot abused the latter to trigger the bug.\\n\\n  write$tun(r0, \u0026(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, \u0027)\u0027, \\\"90e5dd\\\"}}}}, 0x16)\\n\\nllc_conn_handler() initialises local variables {saddr,daddr}.mac\\nbased on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passes\\nthem to __llc_lookup().\\n\\nHowever, the initialisation is done only when skb-\u003eprotocol is\\nhtons(ETH_P_802_2), otherwise, __llc_lookup_established() and\\n__llc_lookup_listener() will read garbage.\\n\\nThe missing initialisation existed prior to commit 211ed865108e\\n(\\\"net: delete all instances of special processing for token ring\\\").\\n\\nIt removed the part to kick out the token ring stuff but forgot to\\nclose the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv().\\n\\nLet\u0027s remove llc_tr_packet_type and complete the deprecation.\\n\\n[0]:\\nBUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90\\n __llc_lookup_established+0xe9d/0xf90\\n __llc_lookup net/llc/llc_conn.c:611 [inline]\\n llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:791\\n llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206\\n __netif_receive_skb_one_core net/core/dev.c:5527 [inline]\\n __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641\\n netif_receive_skb_internal net/core/dev.c:5727 [inline]\\n netif_receive_skb+0x58/0x660 net/core/dev.c:5786\\n tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555\\n tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002\\n tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\\n call_write_iter include/linux/fs.h:2020 [inline]\\n new_sync_write fs/read_write.c:491 [inline]\\n vfs_write+0x8ef/0x1490 fs/read_write.c:584\\n ksys_write+0x20f/0x4c0 fs/read_write.c:637\\n __do_sys_write fs/read_write.c:649 [inline]\\n __se_sys_write fs/read_write.c:646 [inline]\\n __x64_sys_write+0x93/0xd0 fs/read_write.c:646\\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82\\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\\n\\nLocal variable daddr created at:\\n llc_conn_handler+0x53/0x1360 net/llc/llc_conn.c:783\\n llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206\\n\\nCPU: 1 PID: 5004 Comm: syz-executor994 Not tainted 6.6.0-syzkaller-14500-g1c41041124bd #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.307\", \"versionStartIncluding\": \"3.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.269\", \"versionStartIncluding\": \"3.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.210\", \"versionStartIncluding\": \"3.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.149\", \"versionStartIncluding\": \"3.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.76\", \"versionStartIncluding\": \"3.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.15\", \"versionStartIncluding\": \"3.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.3\", \"versionStartIncluding\": \"3.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"3.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:01:13.758Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26635\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:01:13.758Z\", \"dateReserved\": \"2024-02-19T14:20:24.136Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-03-18T10:14:47.213Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.