CVE-2024-26679: inet: read sk->sk_family once in inet_recv_error()
In the Linux kernel, the following vulnerability has been resolved:
inet: read sk->skfamily once in inetrecverror()
inetrecverror() is called without holding the socket lock.
IPv6 socket could mutate to IPv4 with IPV6ADDRFORM socket option and trigger a KCSAN warning.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
inet: read sk->skfamily once in inetrecverror()
The Linux kernel CVE team has assigned CVE-2024-26679 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040253-CVE-2024-26679-d520@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26679?
CVE-2024-26679 is classified with a severity level that may impact the stability and security of affected Linux kernel versions.
How do I fix CVE-2024-26679?
To mitigate CVE-2024-26679, update your Linux kernel to the versions specified by your distribution, specifically those that are 4.19.307, 5.4.269, 5.10.210, 5.15.149, 6.1.78, 6.6.17, 6.7.5, or 6.8 for Red Hat or the versions from Debian as appropriate.
Which Linux kernel versions are affected by CVE-2024-26679?
CVE-2024-26679 affects multiple versions of the Linux kernel, including but not limited to 4.19, 5.4, 5.10, 5.15, 6.1, 6.6, 6.7, and 6.8.
What components are impacted by CVE-2024-26679?
CVE-2024-26679 impacts the inet subsystem within the Linux kernel, particularly affecting functions that handle socket operations.
Is there a public exploit for CVE-2024-26679?
As of now, there is no public exploit available for CVE-2024-26679, but it is advisable to apply the patch to prevent potential exploitation.