CVE-2024-26739 (GCVE-0-2024-26739)

Vulnerability from cvelistv5 – Published: 2024-04-03 17:00 – Updated: 2026-08-05 11:26
VLAI
Title
net/sched: act_mirred: don't override retval if we already lost the skb
Summary
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mirred: don't override retval if we already lost the skb If we're redirecting the skb, and haven't called tcf_mirred_forward(), yet, we need to tell the core to drop the skb by setting the retcode to SHOT. If we have called tcf_mirred_forward(), however, the skb is out of our hands and returning SHOT will lead to UaF. Move the retval override to the error path which actually need it.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:51 UTC
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6641 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e5cf1baf92cb785b90390db1c624948e70c8b8bd , < 0117fe0a4615a7c8d30d6ebcbf87332fbe63e6fd (git)
Affected: e5cf1baf92cb785b90390db1c624948e70c8b8bd , < 9d3ef89b6a5e9f2e940de2cef3d543be0be8dec5 (git)
Affected: e5cf1baf92cb785b90390db1c624948e70c8b8bd , < e873e8f7d03a2ee5b77fb1a305c782fed98e2754 (git)
Affected: e5cf1baf92cb785b90390db1c624948e70c8b8bd , < 28cdbbd38a4413b8eff53399b3f872fd4e80db9d (git)
Affected: e5cf1baf92cb785b90390db1c624948e70c8b8bd , < f4e294bbdca8ac8757db436fc82214f3882fc7e7 (git)
Affected: e5cf1baf92cb785b90390db1c624948e70c8b8bd , < 166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.19
Unaffected: 0 , < 4.19 (semver)
Unaffected: 5.10.238 , ≤ 5.10.* (semver)
Unaffected: 5.15.182 , ≤ 5.15.* (semver)
Unaffected: 6.1.136 , ≤ 6.1.* (semver)
Unaffected: 6.6.19 , ≤ 6.6.* (semver)
Unaffected: 6.7.7 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:29:31.734Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/28cdbbd38a4413b8eff53399b3f872fd4e80db9d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f4e294bbdca8ac8757db436fc82214f3882fc7e7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26739",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:51:53.930424Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:18.399Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/act_mirred.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0117fe0a4615a7c8d30d6ebcbf87332fbe63e6fd",
              "status": "affected",
              "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
              "versionType": "git"
            },
            {
              "lessThan": "9d3ef89b6a5e9f2e940de2cef3d543be0be8dec5",
              "status": "affected",
              "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
              "versionType": "git"
            },
            {
              "lessThan": "e873e8f7d03a2ee5b77fb1a305c782fed98e2754",
              "status": "affected",
              "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
              "versionType": "git"
            },
            {
              "lessThan": "28cdbbd38a4413b8eff53399b3f872fd4e80db9d",
              "status": "affected",
              "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
              "versionType": "git"
            },
            {
              "lessThan": "f4e294bbdca8ac8757db436fc82214f3882fc7e7",
              "status": "affected",
              "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
              "versionType": "git"
            },
            {
              "lessThan": "166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210",
              "status": "affected",
              "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/act_mirred.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.182",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.238",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.182",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.136",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.19",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.7",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_mirred: don\u0027t override retval if we already lost the skb\n\nIf we\u0027re redirecting the skb, and haven\u0027t called tcf_mirred_forward(),\nyet, we need to tell the core to drop the skb by setting the retcode\nto SHOT. If we have called tcf_mirred_forward(), however, the skb\nis out of our hands and returning SHOT will lead to UaF.\n\nMove the retval override to the error path which actually need it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable configuration (ingress qdisc + filter with an act_mirred redirect) must be installed locally via rtnetlink, and the attacker drives the trigger by injecting frames locally into that device. Per kernel scoring convention, tc/qdisc netlink-configured paths are Local.\nAC:L - There is no race or memory-layout precondition; the attacker fully controls both the mirred configuration and the drop condition (unhandled ethertype, or a drop filter/saturated qdisc on the target device), so every injected packet deterministically produces the double free.\nPR:L - Configuring the mirred action requires only CAP_NET_ADMIN within a network namespace, which any unprivileged user obtains via `unshare -Urn`; CAP_NET_RAW in that same user namespace supplies the AF_PACKET frame injection.\nUI:N - The attacker sets up the qdisc/filter and sends the packets entirely on their own; no action by any other user or administrator is needed.\nS:U - The corruption is confined to the kernel\u0027s own heap and privilege domain; no VM, IOMMU, or other security-authority boundary is crossed.\nC:H - The skb and its data buffer are freed twice, so the same slab object is handed to two owners; this use-after-free lets an attacker read the contents of a kernel object aliased onto the reclaimed skb, giving arbitrary kernel memory disclosure.\nI:H - The same double-free/UAF primitive permits heap spraying of the reclaimed skb with attacker-controlled data, yielding a write primitive over adjacent kernel structures and a path to control-flow hijack and privilege escalation.\nA:H - Even without further exploitation, freeing an already-freed skb corrupts the slab freelist and reliably triggers a kernel oops/panic (or BUG on a debug kernel), and it can be repeated at packet rate."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:26:57.172Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0117fe0a4615a7c8d30d6ebcbf87332fbe63e6fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d3ef89b6a5e9f2e940de2cef3d543be0be8dec5"
        },
        {
          "url": "https://git.kernel.org/stable/c/e873e8f7d03a2ee5b77fb1a305c782fed98e2754"
        },
        {
          "url": "https://git.kernel.org/stable/c/28cdbbd38a4413b8eff53399b3f872fd4e80db9d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4e294bbdca8ac8757db436fc82214f3882fc7e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210"
        }
      ],
      "title": "net/sched: act_mirred: don\u0027t override retval if we already lost the skb",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26739",
    "datePublished": "2024-04-03T17:00:24.879Z",
    "dateReserved": "2024-02-19T14:20:24.166Z",
    "dateUpdated": "2026-08-05T11:26:57.172Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26739",
      "date": "2026-11-12",
      "epss": "0.00278",
      "percentile": "0.20505"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:05:17.000Z",
      "cve": "CVE-2024-26739",
      "id": "msrc_CVE-2024-26739",
      "initial_release_date": "2024-04-02T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/sched: act_mirred: don\u0027t override retval if we already lost the skb",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-26739.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sched/act_mirred.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0117fe0a4615a7c8d30d6ebcbf87332fbe63e6fd",
                    "status": "affected",
                    "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9d3ef89b6a5e9f2e940de2cef3d543be0be8dec5",
                    "status": "affected",
                    "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e873e8f7d03a2ee5b77fb1a305c782fed98e2754",
                    "status": "affected",
                    "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "28cdbbd38a4413b8eff53399b3f872fd4e80db9d",
                    "status": "affected",
                    "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f4e294bbdca8ac8757db436fc82214f3882fc7e7",
                    "status": "affected",
                    "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210",
                    "status": "affected",
                    "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/sched/act_mirred.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.19"
                  },
                  {
                    "lessThan": "4.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.238",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.182",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.136",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.19",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.7.*",
                    "status": "unaffected",
                    "version": "6.7.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.8",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C7881168-C074-4F6E-8DDE-02BD994C2EF1",
                    "versionEndExcluding": "5.10.238",
                    "versionStartIncluding": "4.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "57E76AE8-79D9-4EC8-9845-9A86B1ED152E",
                    "versionEndExcluding": "5.15.182",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "27735C1B-DDFC-4860-8952-1D01025F9D4C",
                    "versionEndExcluding": "6.1.136",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8D82004C-B2AE-4048-9344-32EFF65953B0",
                    "versionEndExcluding": "6.6.19",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "575EE16B-67F2-4B5B-B5F8-1877715C898B",
                    "versionEndExcluding": "6.7.7",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "056BD938-0A27-4569-B391-30578B309EE3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F02056A5-B362-4370-9FF8-6F0BD384D520",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "62075ACE-B2A0-4B16-829D-B3DA5AE5CC41",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_mirred: don\u0027t override retval if we already lost the skb\n\nIf we\u0027re redirecting the skb, and haven\u0027t called tcf_mirred_forward(),\nyet, we need to tell the core to drop the skb by setting the retcode\nto SHOT. If we have called tcf_mirred_forward(), however, the skb\nis out of our hands and returning SHOT will lead to UaF.\n\nMove the retval override to the error path which actually need it."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/sched: act_mirred: no anula retval si ya perdimos el skb. Si estamos redirigiendo el skb y a\u00fan no hemos llamado a tcf_mirred_forward(), necesitamos para decirle al n\u00facleo que suelte el skb configurando el c\u00f3digo de retecci\u00f3n en SHOT. Sin embargo, si hemos llamado a tcf_mirred_forward(), el skb est\u00e1 fuera de nuestras manos y devolver SHOT conducir\u00e1 a UaF. Mueva la anulaci\u00f3n de recuperaci\u00f3n a la ruta de error que realmente la necesita."
          }
        ],
        "id": "CVE-2024-26739",
        "lastModified": "2026-08-04T11:17:00.353",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-26739",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:51:53.930424Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-04-03T17:15:51.367",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0117fe0a4615a7c8d30d6ebcbf87332fbe63e6fd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/28cdbbd38a4413b8eff53399b3f872fd4e80db9d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9d3ef89b6a5e9f2e940de2cef3d543be0be8dec5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e873e8f7d03a2ee5b77fb1a305c782fed98e2754"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f4e294bbdca8ac8757db436fc82214f3882fc7e7"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/28cdbbd38a4413b8eff53399b3f872fd4e80db9d"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f4e294bbdca8ac8757db436fc82214f3882fc7e7"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-11-05T11:57:27+00:00",
      "cve": "CVE-2024-26739",
      "id": "CVE-2024-26739",
      "initial_release_date": "2024-04-03T00:00:00+00:00",
      "product_status:fixed": "513",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "49",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/sched: act_mirred: don\u0027t override retval if we already lost the skb",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26739.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T19:29:31.734Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/28cdbbd38a4413b8eff53399b3f872fd4e80db9d"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/f4e294bbdca8ac8757db436fc82214f3882fc7e7"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210"
              },
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
              },
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-26739",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T15:51:53.930424Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:16.047Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "net/sched/act_mirred.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "0117fe0a4615a7c8d30d6ebcbf87332fbe63e6fd",
                  "status": "affected",
                  "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
                  "versionType": "git"
                },
                {
                  "lessThan": "9d3ef89b6a5e9f2e940de2cef3d543be0be8dec5",
                  "status": "affected",
                  "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
                  "versionType": "git"
                },
                {
                  "lessThan": "e873e8f7d03a2ee5b77fb1a305c782fed98e2754",
                  "status": "affected",
                  "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
                  "versionType": "git"
                },
                {
                  "lessThan": "28cdbbd38a4413b8eff53399b3f872fd4e80db9d",
                  "status": "affected",
                  "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
                  "versionType": "git"
                },
                {
                  "lessThan": "f4e294bbdca8ac8757db436fc82214f3882fc7e7",
                  "status": "affected",
                  "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
                  "versionType": "git"
                },
                {
                  "lessThan": "166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210",
                  "status": "affected",
                  "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "net/sched/act_mirred.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.19"
                },
                {
                  "lessThan": "4.19",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.238",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.182",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.136",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.19",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.7.*",
                  "status": "unaffected",
                  "version": "6.7.7",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.8",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.238",
                      "versionStartIncluding": "4.19",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.182",
                      "versionStartIncluding": "4.19",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.136",
                      "versionStartIncluding": "4.19",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.19",
                      "versionStartIncluding": "4.19",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.7.7",
                      "versionStartIncluding": "4.19",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8",
                      "versionStartIncluding": "4.19",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_mirred: don\u0027t override retval if we already lost the skb\n\nIf we\u0027re redirecting the skb, and haven\u0027t called tcf_mirred_forward(),\nyet, we need to tell the core to drop the skb by setting the retcode\nto SHOT. If we have called tcf_mirred_forward(), however, the skb\nis out of our hands and returning SHOT will lead to UaF.\n\nMove the retval override to the error path which actually need it."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerable configuration (ingress qdisc + filter with an act_mirred redirect) must be installed locally via rtnetlink, and the attacker drives the trigger by injecting frames locally into that device. Per kernel scoring convention, tc/qdisc netlink-configured paths are Local.\nAC:L - There is no race or memory-layout precondition; the attacker fully controls both the mirred configuration and the drop condition (unhandled ethertype, or a drop filter/saturated qdisc on the target device), so every injected packet deterministically produces the double free.\nPR:L - Configuring the mirred action requires only CAP_NET_ADMIN within a network namespace, which any unprivileged user obtains via `unshare -Urn`; CAP_NET_RAW in that same user namespace supplies the AF_PACKET frame injection.\nUI:N - The attacker sets up the qdisc/filter and sends the packets entirely on their own; no action by any other user or administrator is needed.\nS:U - The corruption is confined to the kernel\u0027s own heap and privilege domain; no VM, IOMMU, or other security-authority boundary is crossed.\nC:H - The skb and its data buffer are freed twice, so the same slab object is handed to two owners; this use-after-free lets an attacker read the contents of a kernel object aliased onto the reclaimed skb, giving arbitrary kernel memory disclosure.\nI:H - The same double-free/UAF primitive permits heap spraying of the reclaimed skb with attacker-controlled data, yielding a write primitive over adjacent kernel structures and a path to control-flow hijack and privilege escalation.\nA:H - Even without further exploitation, freeing an already-freed skb corrupts the slab freelist and reliably triggers a kernel oops/panic (or BUG on a debug kernel), and it can be repeated at packet rate."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:26:57.172Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/0117fe0a4615a7c8d30d6ebcbf87332fbe63e6fd"
            },
            {
              "url": "https://git.kernel.org/stable/c/9d3ef89b6a5e9f2e940de2cef3d543be0be8dec5"
            },
            {
              "url": "https://git.kernel.org/stable/c/e873e8f7d03a2ee5b77fb1a305c782fed98e2754"
            },
            {
              "url": "https://git.kernel.org/stable/c/28cdbbd38a4413b8eff53399b3f872fd4e80db9d"
            },
            {
              "url": "https://git.kernel.org/stable/c/f4e294bbdca8ac8757db436fc82214f3882fc7e7"
            },
            {
              "url": "https://git.kernel.org/stable/c/166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210"
            }
          ],
          "title": "net/sched: act_mirred: don\u0027t override retval if we already lost the skb",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-26739",
        "datePublished": "2024-04-03T17:00:24.879Z",
        "dateReserved": "2024-02-19T14:20:24.166Z",
        "dateUpdated": "2026-08-05T11:26:57.172Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.