GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-26663 (GCVE-0-2024-26663)

Vulnerability from cvelistv5 – Published: 2024-04-02 06:22 – Updated: 2026-08-05 11:26
VLAI
Title
tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
Summary
In the Linux kernel, the following vulnerability has been resolved: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() syzbot reported the following general protection fault [1]: general protection fault, probably for non-canonical address 0xdffffc0000000010: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000080-0x0000000000000087] ... RIP: 0010:tipc_udp_is_known_peer+0x9c/0x250 net/tipc/udp_media.c:291 ... Call Trace: <TASK> tipc_udp_nl_bearer_add+0x212/0x2f0 net/tipc/udp_media.c:646 tipc_nl_bearer_add+0x21e/0x360 net/tipc/bearer.c:1089 genl_family_rcv_msg_doit+0x1fc/0x2e0 net/netlink/genetlink.c:972 genl_family_rcv_msg net/netlink/genetlink.c:1052 [inline] genl_rcv_msg+0x561/0x800 net/netlink/genetlink.c:1067 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2544 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1367 netlink_sendmsg+0x8b7/0xd70 net/netlink/af_netlink.c:1909 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638 __sys_sendmsg+0x117/0x1e0 net/socket.c:2667 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b The cause of this issue is that when tipc_nl_bearer_add() is called with the TIPC_NLA_BEARER_UDP_OPTS attribute, tipc_udp_nl_bearer_add() is called even if the bearer is not UDP. tipc_udp_is_known_peer() called by tipc_udp_nl_bearer_add() assumes that the media_ptr field of the tipc_bearer has an udp_bearer type object, so the function goes crazy for non-UDP bearers. This patch fixes the issue by checking the bearer type before calling tipc_udp_nl_bearer_add() in tipc_nl_bearer_add().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-03 15:01 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ef20cd4dd1633987bcf46ac34ace2c8af212361f , < 24ec8f0da93b8a9fba11600be8a90f0d73fb46f1 (git)
Affected: ef20cd4dd1633987bcf46ac34ace2c8af212361f , < 6f70f0b412458c622a12d4292782c8e92e210c2f (git)
Affected: ef20cd4dd1633987bcf46ac34ace2c8af212361f , < 19d7314f2fb9515bdaac9829d4d8eb34edd1fe95 (git)
Affected: ef20cd4dd1633987bcf46ac34ace2c8af212361f , < c1701ea85ef0ec7be6a1b36c7da69f572ed2fd12 (git)
Affected: ef20cd4dd1633987bcf46ac34ace2c8af212361f , < 3d3a5b31b43515b5752ff282702ca546ec3e48b6 (git)
Affected: ef20cd4dd1633987bcf46ac34ace2c8af212361f , < 888e3524be87f3df9fa3c083484e4b62b3e3bb59 (git)
Affected: ef20cd4dd1633987bcf46ac34ace2c8af212361f , < 0cd331dfd6023640c9669d0592bc0fd491205f87 (git)
Affected: ef20cd4dd1633987bcf46ac34ace2c8af212361f , < 3871aa01e1a779d866fa9dfdd5a836f342f4eb87 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.9
Unaffected: 0 , < 4.9 (semver)
Unaffected: 4.19.307 , ≤ 4.19.* (semver)
Unaffected: 5.4.269 , ≤ 5.4.* (semver)
Unaffected: 5.10.210 , ≤ 5.10.* (semver)
Unaffected: 5.15.149 , ≤ 5.15.* (semver)
Unaffected: 6.1.78 , ≤ 6.1.* (semver)
Unaffected: 6.6.17 , ≤ 6.6.* (semver)
Unaffected: 6.7.5 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26663",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-03T15:01:46.365302Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:48:45.519Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:12.929Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/24ec8f0da93b8a9fba11600be8a90f0d73fb46f1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6f70f0b412458c622a12d4292782c8e92e210c2f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/19d7314f2fb9515bdaac9829d4d8eb34edd1fe95"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c1701ea85ef0ec7be6a1b36c7da69f572ed2fd12"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3d3a5b31b43515b5752ff282702ca546ec3e48b6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/888e3524be87f3df9fa3c083484e4b62b3e3bb59"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0cd331dfd6023640c9669d0592bc0fd491205f87"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3871aa01e1a779d866fa9dfdd5a836f342f4eb87"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/bearer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "24ec8f0da93b8a9fba11600be8a90f0d73fb46f1",
              "status": "affected",
              "version": "ef20cd4dd1633987bcf46ac34ace2c8af212361f",
              "versionType": "git"
            },
            {
              "lessThan": "6f70f0b412458c622a12d4292782c8e92e210c2f",
              "status": "affected",
              "version": "ef20cd4dd1633987bcf46ac34ace2c8af212361f",
              "versionType": "git"
            },
            {
              "lessThan": "19d7314f2fb9515bdaac9829d4d8eb34edd1fe95",
              "status": "affected",
              "version": "ef20cd4dd1633987bcf46ac34ace2c8af212361f",
              "versionType": "git"
            },
            {
              "lessThan": "c1701ea85ef0ec7be6a1b36c7da69f572ed2fd12",
              "status": "affected",
              "version": "ef20cd4dd1633987bcf46ac34ace2c8af212361f",
              "versionType": "git"
            },
            {
              "lessThan": "3d3a5b31b43515b5752ff282702ca546ec3e48b6",
              "status": "affected",
              "version": "ef20cd4dd1633987bcf46ac34ace2c8af212361f",
              "versionType": "git"
            },
            {
              "lessThan": "888e3524be87f3df9fa3c083484e4b62b3e3bb59",
              "status": "affected",
              "version": "ef20cd4dd1633987bcf46ac34ace2c8af212361f",
              "versionType": "git"
            },
            {
              "lessThan": "0cd331dfd6023640c9669d0592bc0fd491205f87",
              "status": "affected",
              "version": "ef20cd4dd1633987bcf46ac34ace2c8af212361f",
              "versionType": "git"
            },
            {
              "lessThan": "3871aa01e1a779d866fa9dfdd5a836f342f4eb87",
              "status": "affected",
              "version": "ef20cd4dd1633987bcf46ac34ace2c8af212361f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/bearer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.307",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.269",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.307",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.269",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.210",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.149",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.78",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.17",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.5",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: Check the bearer type before calling tipc_udp_nl_bearer_add()\n\nsyzbot reported the following general protection fault [1]:\n\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000010: 0000 [#1] PREEMPT SMP KASAN\nKASAN: null-ptr-deref in range [0x0000000000000080-0x0000000000000087]\n...\nRIP: 0010:tipc_udp_is_known_peer+0x9c/0x250 net/tipc/udp_media.c:291\n...\nCall Trace:\n \u003cTASK\u003e\n tipc_udp_nl_bearer_add+0x212/0x2f0 net/tipc/udp_media.c:646\n tipc_nl_bearer_add+0x21e/0x360 net/tipc/bearer.c:1089\n genl_family_rcv_msg_doit+0x1fc/0x2e0 net/netlink/genetlink.c:972\n genl_family_rcv_msg net/netlink/genetlink.c:1052 [inline]\n genl_rcv_msg+0x561/0x800 net/netlink/genetlink.c:1067\n netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2544\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076\n netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1367\n netlink_sendmsg+0x8b7/0xd70 net/netlink/af_netlink.c:1909\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg+0xd5/0x180 net/socket.c:745\n ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584\n ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638\n __sys_sendmsg+0x117/0x1e0 net/socket.c:2667\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nThe cause of this issue is that when tipc_nl_bearer_add() is called with\nthe TIPC_NLA_BEARER_UDP_OPTS attribute, tipc_udp_nl_bearer_add() is called\neven if the bearer is not UDP.\n\ntipc_udp_is_known_peer() called by tipc_udp_nl_bearer_add() assumes that\nthe media_ptr field of the tipc_bearer has an udp_bearer type object, so\nthe function goes crazy for non-UDP bearers.\n\nThis patch fixes the issue by checking the bearer type before calling\ntipc_udp_nl_bearer_add() in tipc_nl_bearer_add()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through a local generic-netlink `sendmsg` (TIPC_NL_BEARER_ADD), not via remotely received packets, so the attack surface is local.\nAC:L - The attacker controls all preconditions (creating the namespace, a non-UDP bearer, and the malformed netlink message) and can trigger the type confusion deterministically.\nPR:L - TIPC genl ops carry no GENL_ADMIN_PERM check, and even the bearer setup requiring CAP_NET_ADMIN is obtainable by an unprivileged user via user namespaces (unshare -Urn) since TIPC is netns-aware.\nUI:N - The attacker triggers the bug entirely on their own by sending a netlink message; no action from any other user is required.\nS:U - The type confusion and its consequences remain within the kernel\u0027s own security authority; no boundary such as a VM or IOMMU is crossed.\nC:H - The type confusion reads a struct net_device as a udp_bearer and dereferences list pointers taken from adjacent kernel memory, an out-of-type read that can be leveraged for kernel-memory disclosure.\nI:H - Beyond the crash, the confused path can reach list_add_rcu(), writing a pointer into the mis-typed net_device object; type confusion is treated as a High integrity impact.\nA:H - The confusion produces a general protection fault / kernel oops (as reported by syzbot), reliably crashing the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:26:37.773Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/24ec8f0da93b8a9fba11600be8a90f0d73fb46f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f70f0b412458c622a12d4292782c8e92e210c2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/19d7314f2fb9515bdaac9829d4d8eb34edd1fe95"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1701ea85ef0ec7be6a1b36c7da69f572ed2fd12"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d3a5b31b43515b5752ff282702ca546ec3e48b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/888e3524be87f3df9fa3c083484e4b62b3e3bb59"
        },
        {
          "url": "https://git.kernel.org/stable/c/0cd331dfd6023640c9669d0592bc0fd491205f87"
        },
        {
          "url": "https://git.kernel.org/stable/c/3871aa01e1a779d866fa9dfdd5a836f342f4eb87"
        }
      ],
      "title": "tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26663",
    "datePublished": "2024-04-02T06:22:12.537Z",
    "dateReserved": "2024-02-19T14:20:24.148Z",
    "dateUpdated": "2026-08-05T11:26:37.773Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26663",
      "date": "2026-09-17",
      "epss": "0.00248",
      "percentile": "0.16375"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26663\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-02T07:15:43.287\",\"lastModified\":\"2026-08-04T11:16:54.843\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntipc: Check the bearer type before calling tipc_udp_nl_bearer_add()\\n\\nsyzbot reported the following general protection fault [1]:\\n\\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000010: 0000 [#1] PREEMPT SMP KASAN\\nKASAN: null-ptr-deref in range [0x0000000000000080-0x0000000000000087]\\n...\\nRIP: 0010:tipc_udp_is_known_peer+0x9c/0x250 net/tipc/udp_media.c:291\\n...\\nCall Trace:\\n \u003cTASK\u003e\\n tipc_udp_nl_bearer_add+0x212/0x2f0 net/tipc/udp_media.c:646\\n tipc_nl_bearer_add+0x21e/0x360 net/tipc/bearer.c:1089\\n genl_family_rcv_msg_doit+0x1fc/0x2e0 net/netlink/genetlink.c:972\\n genl_family_rcv_msg net/netlink/genetlink.c:1052 [inline]\\n genl_rcv_msg+0x561/0x800 net/netlink/genetlink.c:1067\\n netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2544\\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076\\n netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\\n netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1367\\n netlink_sendmsg+0x8b7/0xd70 net/netlink/af_netlink.c:1909\\n sock_sendmsg_nosec net/socket.c:730 [inline]\\n __sock_sendmsg+0xd5/0x180 net/socket.c:745\\n ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584\\n ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638\\n __sys_sendmsg+0x117/0x1e0 net/socket.c:2667\\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83\\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\\n\\nThe cause of this issue is that when tipc_nl_bearer_add() is called with\\nthe TIPC_NLA_BEARER_UDP_OPTS attribute, tipc_udp_nl_bearer_add() is called\\neven if the bearer is not UDP.\\n\\ntipc_udp_is_known_peer() called by tipc_udp_nl_bearer_add() assumes that\\nthe media_ptr field of the tipc_bearer has an udp_bearer type object, so\\nthe function goes crazy for non-UDP bearers.\\n\\nThis patch fixes the issue by checking the bearer type before calling\\ntipc_udp_nl_bearer_add() in tipc_nl_bearer_add().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: tipc: verifique el tipo de portador antes de llamar a tipc_udp_nl_bearer_add() syzbot inform\u00f3 la siguiente falla de protecci\u00f3n general [1]: falla de protecci\u00f3n general, probablemente para la direcci\u00f3n no can\u00f3nica 0xdffffc0000000010: 0000 [#1 ] PREEMPT SMP KASAN KASAN: null-ptr-deref en el rango [0x00000000000000080-0x0000000000000087] ... RIP: 0010:tipc_udp_is_known_peer+0x9c/0x250 net/tipc/udp_media.c:291 ... Seguimiento de llamadas:  tipc_udp_ nl_bearer_add+ 0x212/0x2f0 net/tipc/udp_media.c:646 tipc_nl_bearer_add+0x21e/0x360 net/tipc/bearer.c:1089 genl_family_rcv_msg_doit+0x1fc/0x2e0 net/netlink/genetlink.c:972 genl_family_rcv_msg net/netlink/genetlink. c:1052 [en l\u00ednea] genl_rcv_msg+0x561/0x800 net/netlink/genetlink.c:1067 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2544 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076 netlink_unicast_kernel net/netlink/ af_netlink.c:1341 [en l\u00ednea] netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1367 netlink_sendmsg+0x8b7/0xd70 net/netlink/af_netlink.c:1909 sock_sendmsg_nosec net/socket.c:730 [en l\u00ednea] __sock_sendmsg+0xd 5 /0x180 net/socket.c:745 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638 __sys_sendmsg+0x117/0x1e0 net/socket.c:2667 do_syscall_x 64 arco/x86/ Entry/common.c:52 [en l\u00ednea] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83 Entry_SYSCALL_64_after_hwframe+0x63/0x6b La causa de este problema es que cuando se llama a tipc_nl_bearer_add() con el atributo TIPC_NLA_BEARER_UDP_OPTS, tipc_udp_nl_bear er_a\u00f1adir () se llama incluso si el portador no es UDP. tipc_udp_is_known_peer() llamado por tipc_udp_nl_bearer_add() supone que el campo media_ptr de tipc_bearer tiene un objeto de tipo udp_bearer, por lo que la funci\u00f3n se vuelve loca para los portadores que no son UDP. Este parche soluciona el problema al verificar el tipo de portador antes de llamar a tipc_udp_nl_bearer_add() en tipc_nl_bearer_add().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/tipc/bearer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ef20cd4dd1633987bcf46ac34ace2c8af212361f\",\"lessThan\":\"24ec8f0da93b8a9fba11600be8a90f0d73fb46f1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ef20cd4dd1633987bcf46ac34ace2c8af212361f\",\"lessThan\":\"6f70f0b412458c622a12d4292782c8e92e210c2f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ef20cd4dd1633987bcf46ac34ace2c8af212361f\",\"lessThan\":\"19d7314f2fb9515bdaac9829d4d8eb34edd1fe95\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ef20cd4dd1633987bcf46ac34ace2c8af212361f\",\"lessThan\":\"c1701ea85ef0ec7be6a1b36c7da69f572ed2fd12\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ef20cd4dd1633987bcf46ac34ace2c8af212361f\",\"lessThan\":\"3d3a5b31b43515b5752ff282702ca546ec3e48b6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ef20cd4dd1633987bcf46ac34ace2c8af212361f\",\"lessThan\":\"888e3524be87f3df9fa3c083484e4b62b3e3bb59\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ef20cd4dd1633987bcf46ac34ace2c8af212361f\",\"lessThan\":\"0cd331dfd6023640c9669d0592bc0fd491205f87\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ef20cd4dd1633987bcf46ac34ace2c8af212361f\",\"lessThan\":\"3871aa01e1a779d866fa9dfdd5a836f342f4eb87\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/tipc/bearer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.307\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.269\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.210\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.149\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.78\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.17\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.5\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-04-03T15:01:46.365302Z\",\"id\":\"CVE-2024-26663\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.9\",\"versionEndExcluding\":\"4.19.307\",\"matchCriteriaId\":\"A1A227E7-C02C-4FC4-84AA-230362C5E2C6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.269\",\"matchCriteriaId\":\"319545F3-D56C-4751-BEBF-0505478BBAE8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.210\",\"matchCriteriaId\":\"F5CB4CA6-A9A0-4AFD-9102-8CF94D708170\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.149\",\"matchCriteriaId\":\"0D0465BB-4053-4E15-9137-6696EBAE90FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.78\",\"matchCriteriaId\":\"26190115-BC0C-4106-9408-E7928FE5DA62\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.17\",\"matchCriteriaId\":\"73F8C6ED-5A0B-4B25-8FA9-AF916A9C8F0B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.5\",\"matchCriteriaId\":\"01925741-2C95-47C1-A7EA-3DC2BB0012D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0cd331dfd6023640c9669d0592bc0fd491205f87\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/19d7314f2fb9515bdaac9829d4d8eb34edd1fe95\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/24ec8f0da93b8a9fba11600be8a90f0d73fb46f1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3871aa01e1a779d866fa9dfdd5a836f342f4eb87\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3d3a5b31b43515b5752ff282702ca546ec3e48b6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6f70f0b412458c622a12d4292782c8e92e210c2f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/888e3524be87f3df9fa3c083484e4b62b3e3bb59\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c1701ea85ef0ec7be6a1b36c7da69f572ed2fd12\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0cd331dfd6023640c9669d0592bc0fd491205f87\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/19d7314f2fb9515bdaac9829d4d8eb34edd1fe95\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/24ec8f0da93b8a9fba11600be8a90f0d73fb46f1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3871aa01e1a779d866fa9dfdd5a836f342f4eb87\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3d3a5b31b43515b5752ff282702ca546ec3e48b6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6f70f0b412458c622a12d4292782c8e92e210c2f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/888e3524be87f3df9fa3c083484e4b62b3e3bb59\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c1701ea85ef0ec7be6a1b36c7da69f572ed2fd12\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:50:42+00:00",
      "cve": "CVE-2024-26663",
      "id": "CVE-2024-26663",
      "initial_release_date": "2024-04-02T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "70",
      "product_status:known_not_affected": "50",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26663.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/24ec8f0da93b8a9fba11600be8a90f0d73fb46f1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/6f70f0b412458c622a12d4292782c8e92e210c2f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/19d7314f2fb9515bdaac9829d4d8eb34edd1fe95\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c1701ea85ef0ec7be6a1b36c7da69f572ed2fd12\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3d3a5b31b43515b5752ff282702ca546ec3e48b6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/888e3524be87f3df9fa3c083484e4b62b3e3bb59\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0cd331dfd6023640c9669d0592bc0fd491205f87\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3871aa01e1a779d866fa9dfdd5a836f342f4eb87\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:12.929Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26663\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-03T15:01:46.365302Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:21.443Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is reached only through a local generic-netlink `sendmsg` (TIPC_NL_BEARER_ADD), not via remotely received packets, so the attack surface is local.\\nAC:L - The attacker controls all preconditions (creating the namespace, a non-UDP bearer, and the malformed netlink message) and can trigger the type confusion deterministically.\\nPR:L - TIPC genl ops carry no GENL_ADMIN_PERM check, and even the bearer setup requiring CAP_NET_ADMIN is obtainable by an unprivileged user via user namespaces (unshare -Urn) since TIPC is netns-aware.\\nUI:N - The attacker triggers the bug entirely on their own by sending a netlink message; no action from any other user is required.\\nS:U - The type confusion and its consequences remain within the kernel\u0027s own security authority; no boundary such as a VM or IOMMU is crossed.\\nC:H - The type confusion reads a struct net_device as a udp_bearer and dereferences list pointers taken from adjacent kernel memory, an out-of-type read that can be leveraged for kernel-memory disclosure.\\nI:H - Beyond the crash, the confused path can reach list_add_rcu(), writing a pointer into the mis-typed net_device object; type confusion is treated as a High integrity impact.\\nA:H - The confusion produces a general protection fault / kernel oops (as reported by syzbot), reliably crashing the kernel.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"ef20cd4dd1633987bcf46ac34ace2c8af212361f\", \"lessThan\": \"24ec8f0da93b8a9fba11600be8a90f0d73fb46f1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ef20cd4dd1633987bcf46ac34ace2c8af212361f\", \"lessThan\": \"6f70f0b412458c622a12d4292782c8e92e210c2f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ef20cd4dd1633987bcf46ac34ace2c8af212361f\", \"lessThan\": \"19d7314f2fb9515bdaac9829d4d8eb34edd1fe95\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ef20cd4dd1633987bcf46ac34ace2c8af212361f\", \"lessThan\": \"c1701ea85ef0ec7be6a1b36c7da69f572ed2fd12\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ef20cd4dd1633987bcf46ac34ace2c8af212361f\", \"lessThan\": \"3d3a5b31b43515b5752ff282702ca546ec3e48b6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ef20cd4dd1633987bcf46ac34ace2c8af212361f\", \"lessThan\": \"888e3524be87f3df9fa3c083484e4b62b3e3bb59\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ef20cd4dd1633987bcf46ac34ace2c8af212361f\", \"lessThan\": \"0cd331dfd6023640c9669d0592bc0fd491205f87\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ef20cd4dd1633987bcf46ac34ace2c8af212361f\", \"lessThan\": \"3871aa01e1a779d866fa9dfdd5a836f342f4eb87\", \"versionType\": \"git\"}], \"programFiles\": [\"net/tipc/bearer.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.307\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.269\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.210\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.149\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.78\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.17\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/tipc/bearer.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/24ec8f0da93b8a9fba11600be8a90f0d73fb46f1\"}, {\"url\": \"https://git.kernel.org/stable/c/6f70f0b412458c622a12d4292782c8e92e210c2f\"}, {\"url\": \"https://git.kernel.org/stable/c/19d7314f2fb9515bdaac9829d4d8eb34edd1fe95\"}, {\"url\": \"https://git.kernel.org/stable/c/c1701ea85ef0ec7be6a1b36c7da69f572ed2fd12\"}, {\"url\": \"https://git.kernel.org/stable/c/3d3a5b31b43515b5752ff282702ca546ec3e48b6\"}, {\"url\": \"https://git.kernel.org/stable/c/888e3524be87f3df9fa3c083484e4b62b3e3bb59\"}, {\"url\": \"https://git.kernel.org/stable/c/0cd331dfd6023640c9669d0592bc0fd491205f87\"}, {\"url\": \"https://git.kernel.org/stable/c/3871aa01e1a779d866fa9dfdd5a836f342f4eb87\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntipc: Check the bearer type before calling tipc_udp_nl_bearer_add()\\n\\nsyzbot reported the following general protection fault [1]:\\n\\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000010: 0000 [#1] PREEMPT SMP KASAN\\nKASAN: null-ptr-deref in range [0x0000000000000080-0x0000000000000087]\\n...\\nRIP: 0010:tipc_udp_is_known_peer+0x9c/0x250 net/tipc/udp_media.c:291\\n...\\nCall Trace:\\n \u003cTASK\u003e\\n tipc_udp_nl_bearer_add+0x212/0x2f0 net/tipc/udp_media.c:646\\n tipc_nl_bearer_add+0x21e/0x360 net/tipc/bearer.c:1089\\n genl_family_rcv_msg_doit+0x1fc/0x2e0 net/netlink/genetlink.c:972\\n genl_family_rcv_msg net/netlink/genetlink.c:1052 [inline]\\n genl_rcv_msg+0x561/0x800 net/netlink/genetlink.c:1067\\n netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2544\\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076\\n netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\\n netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1367\\n netlink_sendmsg+0x8b7/0xd70 net/netlink/af_netlink.c:1909\\n sock_sendmsg_nosec net/socket.c:730 [inline]\\n __sock_sendmsg+0xd5/0x180 net/socket.c:745\\n ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584\\n ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638\\n __sys_sendmsg+0x117/0x1e0 net/socket.c:2667\\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83\\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\\n\\nThe cause of this issue is that when tipc_nl_bearer_add() is called with\\nthe TIPC_NLA_BEARER_UDP_OPTS attribute, tipc_udp_nl_bearer_add() is called\\neven if the bearer is not UDP.\\n\\ntipc_udp_is_known_peer() called by tipc_udp_nl_bearer_add() assumes that\\nthe media_ptr field of the tipc_bearer has an udp_bearer type object, so\\nthe function goes crazy for non-UDP bearers.\\n\\nThis patch fixes the issue by checking the bearer type before calling\\ntipc_udp_nl_bearer_add() in tipc_nl_bearer_add().\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.307\", \"versionStartIncluding\": \"4.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.269\", \"versionStartIncluding\": \"4.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.210\", \"versionStartIncluding\": \"4.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.149\", \"versionStartIncluding\": \"4.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.78\", \"versionStartIncluding\": \"4.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.17\", \"versionStartIncluding\": \"4.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.5\", \"versionStartIncluding\": \"4.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"4.9\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:26:37.773Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26663\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:26:37.773Z\", \"dateReserved\": \"2024-02-19T14:20:24.148Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-02T06:22:12.537Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.