CVE-2024-26739: net/sched: act_mirred: don't override retval if we already lost the skb
In the Linux kernel, the following vulnerability has been resolved:
net/sched: actmirred: don't override retval if we already lost the skb
If we're redirecting the skb, and haven't called tcfmirredforward(), yet, we need to tell the core to drop the skb by setting the retcode to SHOT. If we have called tcfmirredforward(), however, the skb is out of our hands and returning SHOT will lead to UaF.
Move the retval override to the error path which actually need it.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
net/sched: actmirred: don't override retval if we already lost the skb
The Linux kernel CVE team has assigned CVE-2024-26739 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040300-CVE-2024-26739-170e@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.19 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.182.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26739?
CVE-2024-26739 has been classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-26739?
To fix CVE-2024-26739, update your kernel to versions 6.6.19, 6.7.7, or 6.8.
Which Linux kernel versions are affected by CVE-2024-26739?
CVE-2024-26739 affects Linux kernel versions prior to 6.6.19, 6.7.7, and all pre-release versions of 6.8.
What components are vulnerable in CVE-2024-26739?
The vulnerable component in CVE-2024-26739 is the net/sched function in the Linux kernel.
Is there a workaround for CVE-2024-26739?
Currently, the recommended solution for CVE-2024-26739 is to apply the available patches by updating the kernel.