{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.475Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/01129059d5141d62fae692f7a336ae3bc712d3eb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ec92aa2cab6f0048f10d6aa4f025c5885cb1a1b6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e668b92a3a01429923fd5ca13e99642aab47de69"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9376d059a705c5dfaac566c2d09891242013ae16"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/abd32d7f5c0294c1b2454c5a3b13b18446bac627"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/93dd420bc41531c9a31498b9538ca83ba6ec191e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5366969a19a8a0d2ffb3d27ef6e8905e5e4216f8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/616d82c3cfa2a2146dd7e3ae47bda7e877ee549e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26793",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:50:52.672497Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:48.724Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/gtp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "01129059d5141d62fae692f7a336ae3bc712d3eb",
              "status": "affected",
              "version": "459aa660eb1d8ce67080da1983bb81d716aa5a69",
              "versionType": "git"
            },
            {
              "lessThan": "ec92aa2cab6f0048f10d6aa4f025c5885cb1a1b6",
              "status": "affected",
              "version": "459aa660eb1d8ce67080da1983bb81d716aa5a69",
              "versionType": "git"
            },
            {
              "lessThan": "e668b92a3a01429923fd5ca13e99642aab47de69",
              "status": "affected",
              "version": "459aa660eb1d8ce67080da1983bb81d716aa5a69",
              "versionType": "git"
            },
            {
              "lessThan": "9376d059a705c5dfaac566c2d09891242013ae16",
              "status": "affected",
              "version": "459aa660eb1d8ce67080da1983bb81d716aa5a69",
              "versionType": "git"
            },
            {
              "lessThan": "abd32d7f5c0294c1b2454c5a3b13b18446bac627",
              "status": "affected",
              "version": "459aa660eb1d8ce67080da1983bb81d716aa5a69",
              "versionType": "git"
            },
            {
              "lessThan": "93dd420bc41531c9a31498b9538ca83ba6ec191e",
              "status": "affected",
              "version": "459aa660eb1d8ce67080da1983bb81d716aa5a69",
              "versionType": "git"
            },
            {
              "lessThan": "5366969a19a8a0d2ffb3d27ef6e8905e5e4216f8",
              "status": "affected",
              "version": "459aa660eb1d8ce67080da1983bb81d716aa5a69",
              "versionType": "git"
            },
            {
              "lessThan": "616d82c3cfa2a2146dd7e3ae47bda7e877ee549e",
              "status": "affected",
              "version": "459aa660eb1d8ce67080da1983bb81d716aa5a69",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/gtp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.309",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.309",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.271",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.212",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.151",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.81",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.21",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.9",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngtp: fix use-after-free and null-ptr-deref in gtp_newlink()\n\nThe gtp_link_ops operations structure for the subsystem must be\nregistered after registering the gtp_net_ops pernet operations structure.\n\nSyzkaller hit \u0027general protection fault in gtp_genl_dump_pdp\u0027 bug:\n\n[ 1010.702740] gtp: GTP module unloaded\n[ 1010.715877] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI\n[ 1010.715888] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n[ 1010.715895] CPU: 1 PID: 128616 Comm: a.out Not tainted 6.8.0-rc6-std-def-alt1 #1\n[ 1010.715899] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014\n[ 1010.715908] RIP: 0010:gtp_newlink+0x4d7/0x9c0 [gtp]\n[ 1010.715915] Code: 80 3c 02 00 0f 85 41 04 00 00 48 8b bb d8 05 00 00 e8 ed f6 ff ff 48 89 c2 48 89 c5 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 4f 04 00 00 4c 89 e2 4c 8b 6d 00 48 b8 00 00 00\n[ 1010.715920] RSP: 0018:ffff888020fbf180 EFLAGS: 00010203\n[ 1010.715929] RAX: dffffc0000000000 RBX: ffff88800399c000 RCX: 0000000000000000\n[ 1010.715933] RDX: 0000000000000001 RSI: ffffffff84805280 RDI: 0000000000000282\n[ 1010.715938] RBP: 000000000000000d R08: 0000000000000001 R09: 0000000000000000\n[ 1010.715942] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800399cc80\n[ 1010.715947] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000400\n[ 1010.715953] FS:  00007fd1509ab5c0(0000) GS:ffff88805b300000(0000) knlGS:0000000000000000\n[ 1010.715958] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1010.715962] CR2: 0000000000000000 CR3: 000000001c07a000 CR4: 0000000000750ee0\n[ 1010.715968] PKRU: 55555554\n[ 1010.715972] Call Trace:\n[ 1010.715985]  ? __die_body.cold+0x1a/0x1f\n[ 1010.715995]  ? die_addr+0x43/0x70\n[ 1010.716002]  ? exc_general_protection+0x199/0x2f0\n[ 1010.716016]  ? asm_exc_general_protection+0x1e/0x30\n[ 1010.716026]  ? gtp_newlink+0x4d7/0x9c0 [gtp]\n[ 1010.716034]  ? gtp_net_exit+0x150/0x150 [gtp]\n[ 1010.716042]  __rtnl_newlink+0x1063/0x1700\n[ 1010.716051]  ? rtnl_setlink+0x3c0/0x3c0\n[ 1010.716063]  ? is_bpf_text_address+0xc0/0x1f0\n[ 1010.716070]  ? kernel_text_address.part.0+0xbb/0xd0\n[ 1010.716076]  ? __kernel_text_address+0x56/0xa0\n[ 1010.716084]  ? unwind_get_return_address+0x5a/0xa0\n[ 1010.716091]  ? create_prof_cpu_mask+0x30/0x30\n[ 1010.716098]  ? arch_stack_walk+0x9e/0xf0\n[ 1010.716106]  ? stack_trace_save+0x91/0xd0\n[ 1010.716113]  ? stack_trace_consume_entry+0x170/0x170\n[ 1010.716121]  ? __lock_acquire+0x15c5/0x5380\n[ 1010.716139]  ? mark_held_locks+0x9e/0xe0\n[ 1010.716148]  ? kmem_cache_alloc_trace+0x35f/0x3c0\n[ 1010.716155]  ? __rtnl_newlink+0x1700/0x1700\n[ 1010.716160]  rtnl_newlink+0x69/0xa0\n[ 1010.716166]  rtnetlink_rcv_msg+0x43b/0xc50\n[ 1010.716172]  ? rtnl_fdb_dump+0x9f0/0x9f0\n[ 1010.716179]  ? lock_acquire+0x1fe/0x560\n[ 1010.716188]  ? netlink_deliver_tap+0x12f/0xd50\n[ 1010.716196]  netlink_rcv_skb+0x14d/0x440\n[ 1010.716202]  ? rtnl_fdb_dump+0x9f0/0x9f0\n[ 1010.716208]  ? netlink_ack+0xab0/0xab0\n[ 1010.716213]  ? netlink_deliver_tap+0x202/0xd50\n[ 1010.716220]  ? netlink_deliver_tap+0x218/0xd50\n[ 1010.716226]  ? __virt_addr_valid+0x30b/0x590\n[ 1010.716233]  netlink_unicast+0x54b/0x800\n[ 1010.716240]  ? netlink_attachskb+0x870/0x870\n[ 1010.716248]  ? __check_object_size+0x2de/0x3b0\n[ 1010.716254]  netlink_sendmsg+0x938/0xe40\n[ 1010.716261]  ? netlink_unicast+0x800/0x800\n[ 1010.716269]  ? __import_iovec+0x292/0x510\n[ 1010.716276]  ? netlink_unicast+0x800/0x800\n[ 1010.716284]  __sock_sendmsg+0x159/0x190\n[ 1010.716290]  ____sys_sendmsg+0x712/0x880\n[ 1010.716297]  ? sock_write_iter+0x3d0/0x3d0\n[ 1010.716304]  ? __ia32_sys_recvmmsg+0x270/0x270\n[ 1010.716309]  ? lock_acquire+0x1fe/0x560\n[ 1010.716315]  ? drain_array_locked+0x90/0x90\n[ 1010.716324]  ___sys_sendmsg+0xf8/0x170\n[ 1010.716331]  ? sendmsg_copy_msghdr+0x170/0x170\n[ 1010.716337]  ? lockdep_init_map\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered by an `RTM_NEWLINK` rtnetlink message with `IFLA_INFO_KIND=\"gtp\"` sent over an `AF_NETLINK` socket via `sendmsg()`, which requires local system access. There is no remote or adjacent-network path into `gtp_newlink()`.\nAC:L - The attacker creates and controls both sides of the race \u2014 one thread\u0027s own `RTM_NEWLINK` triggers `request_module(\"rtnl-link-gtp\")` while sibling threads block on `rtnl_lock` inside `__rtnl_newlink()`, and `rtnl_link_register()` releasing that lock inside `gtp_init()` hands a waiter the lock before `register_pernet_subsys()` completes. Syzkaller reproduced it from an ordinary userspace binary, and the same inverted ordering is also hit deterministically on the module-init error path.\nPR:L - `rtnetlink_rcv_msg()` only requires `netlink_net_capable(skb, CAP_NET_ADMIN)`, which is evaluated against the socket\u0027s `net-\u003euser_ns`, so an unprivileged user obtains it with `unshare -Urn`. Module autoload via `request_module()` in `__rtnl_newlink()` adds no further capability gate, so no real root is needed.\nUI:N - The attacker performs the entire sequence \u2014 autoload trigger plus racing link-creation requests \u2014 from their own threads. No victim action or pre-existing system state is required.\nS:U - The corruption stays within the kernel\u0027s own memory and security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - `ops_free_list()` frees the per-net `struct gtp_net` without clearing `ng-\u003eptr[id]`, so `net_generic()` returns a dangling pointer whose reused slab contents are read as a list head and subsequently walked and marshalled to userspace by `gtp_genl_dump_pdp()`, giving a use-after-free read primitive over adjacent kernel heap data.\nI:H - `__list_add_rcu()` performs `next-\u003eprev = new` where `next` is read from the freed/garbage `gn-\u003egtp_dev_list`, so an attacker who sprays the reallocated 16-byte object controls the destination and writes a kernel heap pointer to an arbitrary address \u2014 a write primitive suitable for control-flow hijacking.\nA:H - The unfixed path reliably produces a general protection fault / null-pointer dereference in `gtp_newlink()` (the reported oops), and the use-after-free variant corrupts the slab, both resulting in kernel crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:27:17.339Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/01129059d5141d62fae692f7a336ae3bc712d3eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec92aa2cab6f0048f10d6aa4f025c5885cb1a1b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/e668b92a3a01429923fd5ca13e99642aab47de69"
        },
        {
          "url": "https://git.kernel.org/stable/c/9376d059a705c5dfaac566c2d09891242013ae16"
        },
        {
          "url": "https://git.kernel.org/stable/c/abd32d7f5c0294c1b2454c5a3b13b18446bac627"
        },
        {
          "url": "https://git.kernel.org/stable/c/93dd420bc41531c9a31498b9538ca83ba6ec191e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5366969a19a8a0d2ffb3d27ef6e8905e5e4216f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/616d82c3cfa2a2146dd7e3ae47bda7e877ee549e"
        }
      ],
      "title": "gtp: fix use-after-free and null-ptr-deref in gtp_newlink()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26793",
    "datePublished": "2024-04-04T08:20:23.771Z",
    "dateReserved": "2024-02-19T14:20:24.178Z",
    "dateUpdated": "2026-08-05T11:27:17.339Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26793",
      "date": "2026-08-26",
      "epss": "0.00291",
      "percentile": "0.21101"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26793\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-04T09:15:08.620\",\"lastModified\":\"2026-08-04T11:17:05.470\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngtp: fix use-after-free and null-ptr-deref in gtp_newlink()\\n\\nThe gtp_link_ops operations structure for the subsystem must be\\nregistered after registering the gtp_net_ops pernet operations structure.\\n\\nSyzkaller hit \u0027general protection fault in gtp_genl_dump_pdp\u0027 bug:\\n\\n[ 1010.702740] gtp: GTP module unloaded\\n[ 1010.715877] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI\\n[ 1010.715888] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\\n[ 1010.715895] CPU: 1 PID: 128616 Comm: a.out Not tainted 6.8.0-rc6-std-def-alt1 #1\\n[ 1010.715899] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014\\n[ 1010.715908] RIP: 0010:gtp_newlink+0x4d7/0x9c0 [gtp]\\n[ 1010.715915] Code: 80 3c 02 00 0f 85 41 04 00 00 48 8b bb d8 05 00 00 e8 ed f6 ff ff 48 89 c2 48 89 c5 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 4f 04 00 00 4c 89 e2 4c 8b 6d 00 48 b8 00 00 00\\n[ 1010.715920] RSP: 0018:ffff888020fbf180 EFLAGS: 00010203\\n[ 1010.715929] RAX: dffffc0000000000 RBX: ffff88800399c000 RCX: 0000000000000000\\n[ 1010.715933] RDX: 0000000000000001 RSI: ffffffff84805280 RDI: 0000000000000282\\n[ 1010.715938] RBP: 000000000000000d R08: 0000000000000001 R09: 0000000000000000\\n[ 1010.715942] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800399cc80\\n[ 1010.715947] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000400\\n[ 1010.715953] FS:  00007fd1509ab5c0(0000) GS:ffff88805b300000(0000) knlGS:0000000000000000\\n[ 1010.715958] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[ 1010.715962] CR2: 0000000000000000 CR3: 000000001c07a000 CR4: 0000000000750ee0\\n[ 1010.715968] PKRU: 55555554\\n[ 1010.715972] Call Trace:\\n[ 1010.715985]  ? __die_body.cold+0x1a/0x1f\\n[ 1010.715995]  ? die_addr+0x43/0x70\\n[ 1010.716002]  ? exc_general_protection+0x199/0x2f0\\n[ 1010.716016]  ? asm_exc_general_protection+0x1e/0x30\\n[ 1010.716026]  ? gtp_newlink+0x4d7/0x9c0 [gtp]\\n[ 1010.716034]  ? gtp_net_exit+0x150/0x150 [gtp]\\n[ 1010.716042]  __rtnl_newlink+0x1063/0x1700\\n[ 1010.716051]  ? rtnl_setlink+0x3c0/0x3c0\\n[ 1010.716063]  ? is_bpf_text_address+0xc0/0x1f0\\n[ 1010.716070]  ? kernel_text_address.part.0+0xbb/0xd0\\n[ 1010.716076]  ? __kernel_text_address+0x56/0xa0\\n[ 1010.716084]  ? unwind_get_return_address+0x5a/0xa0\\n[ 1010.716091]  ? create_prof_cpu_mask+0x30/0x30\\n[ 1010.716098]  ? arch_stack_walk+0x9e/0xf0\\n[ 1010.716106]  ? stack_trace_save+0x91/0xd0\\n[ 1010.716113]  ? stack_trace_consume_entry+0x170/0x170\\n[ 1010.716121]  ? __lock_acquire+0x15c5/0x5380\\n[ 1010.716139]  ? mark_held_locks+0x9e/0xe0\\n[ 1010.716148]  ? kmem_cache_alloc_trace+0x35f/0x3c0\\n[ 1010.716155]  ? __rtnl_newlink+0x1700/0x1700\\n[ 1010.716160]  rtnl_newlink+0x69/0xa0\\n[ 1010.716166]  rtnetlink_rcv_msg+0x43b/0xc50\\n[ 1010.716172]  ? rtnl_fdb_dump+0x9f0/0x9f0\\n[ 1010.716179]  ? lock_acquire+0x1fe/0x560\\n[ 1010.716188]  ? netlink_deliver_tap+0x12f/0xd50\\n[ 1010.716196]  netlink_rcv_skb+0x14d/0x440\\n[ 1010.716202]  ? rtnl_fdb_dump+0x9f0/0x9f0\\n[ 1010.716208]  ? netlink_ack+0xab0/0xab0\\n[ 1010.716213]  ? netlink_deliver_tap+0x202/0xd50\\n[ 1010.716220]  ? netlink_deliver_tap+0x218/0xd50\\n[ 1010.716226]  ? __virt_addr_valid+0x30b/0x590\\n[ 1010.716233]  netlink_unicast+0x54b/0x800\\n[ 1010.716240]  ? netlink_attachskb+0x870/0x870\\n[ 1010.716248]  ? __check_object_size+0x2de/0x3b0\\n[ 1010.716254]  netlink_sendmsg+0x938/0xe40\\n[ 1010.716261]  ? netlink_unicast+0x800/0x800\\n[ 1010.716269]  ? __import_iovec+0x292/0x510\\n[ 1010.716276]  ? netlink_unicast+0x800/0x800\\n[ 1010.716284]  __sock_sendmsg+0x159/0x190\\n[ 1010.716290]  ____sys_sendmsg+0x712/0x880\\n[ 1010.716297]  ? sock_write_iter+0x3d0/0x3d0\\n[ 1010.716304]  ? __ia32_sys_recvmmsg+0x270/0x270\\n[ 1010.716309]  ? lock_acquire+0x1fe/0x560\\n[ 1010.716315]  ? drain_array_locked+0x90/0x90\\n[ 1010.716324]  ___sys_sendmsg+0xf8/0x170\\n[ 1010.716331]  ? sendmsg_copy_msghdr+0x170/0x170\\n[ 1010.716337]  ? lockdep_init_map\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: gtp: corrige use-after-free y null-ptr-deref en gtp_newlink() La estructura de operaciones gtp_link_ops para el subSYSTEM debe registrarse despu\u00e9s de registrar la estructura de operaciones pernet gtp_net_ops. Syzkaller encontr\u00f3 el error \u0027fallo de protecci\u00f3n general en gtp_genl_dump_pdp\u0027: [1010.702740] gtp: m\u00f3dulo GTP descargado [1010.715877] fallo de protecci\u00f3n general, probablemente para la direcci\u00f3n no can\u00f3nica 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI [1010.715888 ] KASAN: ptr nulo -deref en el rango [0x0000000000000008-0x000000000000000f] [ 1010.715895] CPU: 1 PID: 128616 Comm: a.out No contaminado 6.8.0-rc6-std-def-alt1 #1 [ 1010.715899] Nombre de hardware: Est\u00e1ndar QEMU PC (Q35+ ICH9, 2009), BIOS 1.16.0-alt1 01/04/2014 [ 1010.715908] RIP: 0010:gtp_newlink+0x4d7/0x9c0 [gtp] [ 1010.715915] C\u00f3digo: 80 3c 02 00 0f 85 41 04 00 0 0 48 8b bb d8 05 00 00 e8 ed f6 ff ff 48 89 c2 48 89 c5 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 \u0026lt;80\u0026gt; 3c 02 00 0f 85 4f 04 00 00 4c 89 e2 4c 8b 6d 00 4 8b8 00 00 00 [ 1010.715920] RSP: 0018:ffff888020fbf180 EFLAGS: 00010203 [ 1010.715929] RAX: dffffc0000000000 RBX: ffff88800399c000 RCX: 0000000000000 000 [ 1010.715933] RDX: 00000000000000001 RSI: ffffffff84805280 RDI: 0000000000000282 [ 1010.715938] RBP: 000000000000000d R08: 000000000000 0001 R09: 0000000000000000 [ 1010.715942] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800399cc80 [ 1010.715947] R13: 0000000000000000 R14: 00000000000 00000 R15: 0000000000000400 [ 1010.715953] FS: 00007fd1509ab5c0(0000) GS:ffff88805b300000(0000) knlGS:0000000000000000 [ 1010.715958] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1010.715962] CR2: 0000000000000000 CR3: 000000001c07a000 CR4: 0000000000750ee0 [ 1010.715968] PKRU: 55555 554 [1010.715972] Seguimiento de llamadas: [1010.715985]? __die_body.cold+0x1a/0x1f [ 1010.715995] ? die_addr+0x43/0x70 [1010.716002]? exc_general_protection+0x199/0x2f0 [1010.716016]? asm_exc_general_protection+0x1e/0x30 [1010.716026]? gtp_newlink+0x4d7/0x9c0 [gtp] [ 1010.716034] ? gtp_net_exit+0x150/0x150 [gtp] [ 1010.716042] __rtnl_newlink+0x1063/0x1700 [ 1010.716051] ? rtnl_setlink+0x3c0/0x3c0 [1010.716063]? is_bpf_text_address+0xc0/0x1f0 [1010.716070]? kernel_text_address.part.0+0xbb/0xd0 [1010.716076]? __kernel_text_address+0x56/0xa0 [ 1010.716084] ? unwind_get_return_address+0x5a/0xa0 [1010.716091]? create_prof_cpu_mask+0x30/0x30 [1010.716098]? arch_stack_walk+0x9e/0xf0 [1010.716106]? stack_trace_save+0x91/0xd0 [1010.716113]? stack_trace_consume_entry+0x170/0x170 [1010.716121]? __lock_acquire+0x15c5/0x5380 [1010.716139]? mark_held_locks+0x9e/0xe0 [1010.716148]? \u00bfkmem_cache_alloc_trace+0x35f/0x3c0 [1010.716155]? __rtnl_newlink+0x1700/0x1700 [ 1010.716160] rtnl_newlink+0x69/0xa0 [ 1010.716166] rtnetlink_rcv_msg+0x43b/0xc50 [ 1010.716172] ? rtnl_fdb_dump+0x9f0/0x9f0 [1010.716179]? lock_acquire+0x1fe/0x560 [1010.716188]? netlink_deliver_tap+0x12f/0xd50 [ 1010.716196] netlink_rcv_skb+0x14d/0x440 [ 1010.716202] ? rtnl_fdb_dump+0x9f0/0x9f0 [1010.716208]? netlink_ack+0xab0/0xab0 [1010.716213]? netlink_deliver_tap+0x202/0xd50 [1010.716220]? netlink_deliver_tap+0x218/0xd50 [1010.716226]? __virt_addr_valid+0x30b/0x590 [ 1010.716233] netlink_unicast+0x54b/0x800 [ 1010.716240] ? netlink_attachskb+0x870/0x870 [1010.716248]? __check_object_size+0x2de/0x3b0 [ 1010.716254] netlink_sendmsg+0x938/0xe40 [ 1010.716261] ? netlink_unicast+0x800/0x800 [1010.716269]? __import_iovec+0x292/0x510 [ 1010.716276] ? netlink_unicast+0x800/0x800 [ 1010.716284] __sock_sendmsg+0x159/0x190 [ 1010.716290] ____sys_sendmsg+0x712/0x880 [ 1010.716297] ? sock_write_iter+0x3d0/0x3d0 [1010.716304]? __ia32_sys_recvmmsg+0x270/0x270 [1010.716309]? lock_acquire+0x1fe/0x560 [1010.716315]? Drain_array_locked+0x90/0x90 [ 1010.716324] ___sys_sendmsg+0xf8/0x170 [ 1010.716331] ? sendmsg_copy_msghdr+0x170/0x170 [1010.716337]? lockdep_init_map ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/gtp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"459aa660eb1d8ce67080da1983bb81d716aa5a69\",\"lessThan\":\"01129059d5141d62fae692f7a336ae3bc712d3eb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"459aa660eb1d8ce67080da1983bb81d716aa5a69\",\"lessThan\":\"ec92aa2cab6f0048f10d6aa4f025c5885cb1a1b6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"459aa660eb1d8ce67080da1983bb81d716aa5a69\",\"lessThan\":\"e668b92a3a01429923fd5ca13e99642aab47de69\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"459aa660eb1d8ce67080da1983bb81d716aa5a69\",\"lessThan\":\"9376d059a705c5dfaac566c2d09891242013ae16\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"459aa660eb1d8ce67080da1983bb81d716aa5a69\",\"lessThan\":\"abd32d7f5c0294c1b2454c5a3b13b18446bac627\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"459aa660eb1d8ce67080da1983bb81d716aa5a69\",\"lessThan\":\"93dd420bc41531c9a31498b9538ca83ba6ec191e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"459aa660eb1d8ce67080da1983bb81d716aa5a69\",\"lessThan\":\"5366969a19a8a0d2ffb3d27ef6e8905e5e4216f8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"459aa660eb1d8ce67080da1983bb81d716aa5a69\",\"lessThan\":\"616d82c3cfa2a2146dd7e3ae47bda7e877ee549e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/gtp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.309\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.271\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.212\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.151\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.81\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.21\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.9\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T15:50:52.672497Z\",\"id\":\"CVE-2024-26793\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"},{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.7\",\"versionEndExcluding\":\"4.19.309\",\"matchCriteriaId\":\"AC54329E-05C1-4B14-9E7D-E2F71295B965\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.271\",\"matchCriteriaId\":\"7BE17E30-58A5-468C-A06E-28C355F4F8DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.212\",\"matchCriteriaId\":\"01B34738-A022-44A9-9250-DCBC76539CB9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.151\",\"matchCriteriaId\":\"EEAFD33E-C22F-4FB1-A417-9C96AB3E0358\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.81\",\"matchCriteriaId\":\"EC825B0E-DFCA-4034-9B92-F111A4E2A732\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.21\",\"matchCriteriaId\":\"B19074A2-9FE5-4E7D-9E2D-020F95013ADA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.9\",\"matchCriteriaId\":\"1C538467-EDA0-4A9A-82EB-2925DE9FF827\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"A780F817-2A77-4130-A9B7-5C25606314E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"AEB9199B-AB8F-4877-8964-E2BA95B5F15C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/01129059d5141d62fae692f7a336ae3bc712d3eb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5366969a19a8a0d2ffb3d27ef6e8905e5e4216f8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/616d82c3cfa2a2146dd7e3ae47bda7e877ee549e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9376d059a705c5dfaac566c2d09891242013ae16\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/93dd420bc41531c9a31498b9538ca83ba6ec191e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/abd32d7f5c0294c1b2454c5a3b13b18446bac627\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e668b92a3a01429923fd5ca13e99642aab47de69\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ec92aa2cab6f0048f10d6aa4f025c5885cb1a1b6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/01129059d5141d62fae692f7a336ae3bc712d3eb\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5366969a19a8a0d2ffb3d27ef6e8905e5e4216f8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/616d82c3cfa2a2146dd7e3ae47bda7e877ee549e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9376d059a705c5dfaac566c2d09891242013ae16\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/93dd420bc41531c9a31498b9538ca83ba6ec191e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/abd32d7f5c0294c1b2454c5a3b13b18446bac627\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e668b92a3a01429923fd5ca13e99642aab47de69\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ec92aa2cab6f0048f10d6aa4f025c5885cb1a1b6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:11:23+00:00",
      "cve": "CVE-2024-26793",
      "id": "CVE-2024-26793",
      "initial_release_date": "2024-04-04T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: gtp: fix use-after-free and null-ptr-deref in gtp_newlink()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26793.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/01129059d5141d62fae692f7a336ae3bc712d3eb\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ec92aa2cab6f0048f10d6aa4f025c5885cb1a1b6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e668b92a3a01429923fd5ca13e99642aab47de69\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9376d059a705c5dfaac566c2d09891242013ae16\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/abd32d7f5c0294c1b2454c5a3b13b18446bac627\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/93dd420bc41531c9a31498b9538ca83ba6ec191e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5366969a19a8a0d2ffb3d27ef6e8905e5e4216f8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/616d82c3cfa2a2146dd7e3ae47bda7e877ee549e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.475Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26793\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:50:52.672497Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:18.877Z\"}}], \"cna\": {\"title\": \"gtp: fix use-after-free and null-ptr-deref in gtp_newlink()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerability is triggered by an `RTM_NEWLINK` rtnetlink message with `IFLA_INFO_KIND=\\\"gtp\\\"` sent over an `AF_NETLINK` socket via `sendmsg()`, which requires local system access. There is no remote or adjacent-network path into `gtp_newlink()`.\\nAC:L - The attacker creates and controls both sides of the race \\u2014 one thread\u0027s own `RTM_NEWLINK` triggers `request_module(\\\"rtnl-link-gtp\\\")` while sibling threads block on `rtnl_lock` inside `__rtnl_newlink()`, and `rtnl_link_register()` releasing that lock inside `gtp_init()` hands a waiter the lock before `register_pernet_subsys()` completes. Syzkaller reproduced it from an ordinary userspace binary, and the same inverted ordering is also hit deterministically on the module-init error path.\\nPR:L - `rtnetlink_rcv_msg()` only requires `netlink_net_capable(skb, CAP_NET_ADMIN)`, which is evaluated against the socket\u0027s `net-\u003euser_ns`, so an unprivileged user obtains it with `unshare -Urn`. Module autoload via `request_module()` in `__rtnl_newlink()` adds no further capability gate, so no real root is needed.\\nUI:N - The attacker performs the entire sequence \\u2014 autoload trigger plus racing link-creation requests \\u2014 from their own threads. No victim action or pre-existing system state is required.\\nS:U - The corruption stays within the kernel\u0027s own memory and security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\\nC:H - `ops_free_list()` frees the per-net `struct gtp_net` without clearing `ng-\u003eptr[id]`, so `net_generic()` returns a dangling pointer whose reused slab contents are read as a list head and subsequently walked and marshalled to userspace by `gtp_genl_dump_pdp()`, giving a use-after-free read primitive over adjacent kernel heap data.\\nI:H - `__list_add_rcu()` performs `next-\u003eprev = new` where `next` is read from the freed/garbage `gn-\u003egtp_dev_list`, so an attacker who sprays the reallocated 16-byte object controls the destination and writes a kernel heap pointer to an arbitrary address \\u2014 a write primitive suitable for control-flow hijacking.\\nA:H - The unfixed path reliably produces a general protection fault / null-pointer dereference in `gtp_newlink()` (the reported oops), and the use-after-free variant corrupts the slab, both resulting in kernel crashes.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"459aa660eb1d8ce67080da1983bb81d716aa5a69\", \"lessThan\": \"01129059d5141d62fae692f7a336ae3bc712d3eb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"459aa660eb1d8ce67080da1983bb81d716aa5a69\", \"lessThan\": \"ec92aa2cab6f0048f10d6aa4f025c5885cb1a1b6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"459aa660eb1d8ce67080da1983bb81d716aa5a69\", \"lessThan\": \"e668b92a3a01429923fd5ca13e99642aab47de69\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"459aa660eb1d8ce67080da1983bb81d716aa5a69\", \"lessThan\": \"9376d059a705c5dfaac566c2d09891242013ae16\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"459aa660eb1d8ce67080da1983bb81d716aa5a69\", \"lessThan\": \"abd32d7f5c0294c1b2454c5a3b13b18446bac627\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"459aa660eb1d8ce67080da1983bb81d716aa5a69\", \"lessThan\": \"93dd420bc41531c9a31498b9538ca83ba6ec191e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"459aa660eb1d8ce67080da1983bb81d716aa5a69\", \"lessThan\": \"5366969a19a8a0d2ffb3d27ef6e8905e5e4216f8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"459aa660eb1d8ce67080da1983bb81d716aa5a69\", \"lessThan\": \"616d82c3cfa2a2146dd7e3ae47bda7e877ee549e\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/gtp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.309\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.271\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.212\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.151\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.81\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.21\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/gtp.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/01129059d5141d62fae692f7a336ae3bc712d3eb\"}, {\"url\": \"https://git.kernel.org/stable/c/ec92aa2cab6f0048f10d6aa4f025c5885cb1a1b6\"}, {\"url\": \"https://git.kernel.org/stable/c/e668b92a3a01429923fd5ca13e99642aab47de69\"}, {\"url\": \"https://git.kernel.org/stable/c/9376d059a705c5dfaac566c2d09891242013ae16\"}, {\"url\": \"https://git.kernel.org/stable/c/abd32d7f5c0294c1b2454c5a3b13b18446bac627\"}, {\"url\": \"https://git.kernel.org/stable/c/93dd420bc41531c9a31498b9538ca83ba6ec191e\"}, {\"url\": \"https://git.kernel.org/stable/c/5366969a19a8a0d2ffb3d27ef6e8905e5e4216f8\"}, {\"url\": \"https://git.kernel.org/stable/c/616d82c3cfa2a2146dd7e3ae47bda7e877ee549e\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngtp: fix use-after-free and null-ptr-deref in gtp_newlink()\\n\\nThe gtp_link_ops operations structure for the subsystem must be\\nregistered after registering the gtp_net_ops pernet operations structure.\\n\\nSyzkaller hit \u0027general protection fault in gtp_genl_dump_pdp\u0027 bug:\\n\\n[ 1010.702740] gtp: GTP module unloaded\\n[ 1010.715877] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI\\n[ 1010.715888] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\\n[ 1010.715895] CPU: 1 PID: 128616 Comm: a.out Not tainted 6.8.0-rc6-std-def-alt1 #1\\n[ 1010.715899] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014\\n[ 1010.715908] RIP: 0010:gtp_newlink+0x4d7/0x9c0 [gtp]\\n[ 1010.715915] Code: 80 3c 02 00 0f 85 41 04 00 00 48 8b bb d8 05 00 00 e8 ed f6 ff ff 48 89 c2 48 89 c5 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 4f 04 00 00 4c 89 e2 4c 8b 6d 00 48 b8 00 00 00\\n[ 1010.715920] RSP: 0018:ffff888020fbf180 EFLAGS: 00010203\\n[ 1010.715929] RAX: dffffc0000000000 RBX: ffff88800399c000 RCX: 0000000000000000\\n[ 1010.715933] RDX: 0000000000000001 RSI: ffffffff84805280 RDI: 0000000000000282\\n[ 1010.715938] RBP: 000000000000000d R08: 0000000000000001 R09: 0000000000000000\\n[ 1010.715942] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800399cc80\\n[ 1010.715947] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000400\\n[ 1010.715953] FS:  00007fd1509ab5c0(0000) GS:ffff88805b300000(0000) knlGS:0000000000000000\\n[ 1010.715958] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[ 1010.715962] CR2: 0000000000000000 CR3: 000000001c07a000 CR4: 0000000000750ee0\\n[ 1010.715968] PKRU: 55555554\\n[ 1010.715972] Call Trace:\\n[ 1010.715985]  ? __die_body.cold+0x1a/0x1f\\n[ 1010.715995]  ? die_addr+0x43/0x70\\n[ 1010.716002]  ? exc_general_protection+0x199/0x2f0\\n[ 1010.716016]  ? asm_exc_general_protection+0x1e/0x30\\n[ 1010.716026]  ? gtp_newlink+0x4d7/0x9c0 [gtp]\\n[ 1010.716034]  ? gtp_net_exit+0x150/0x150 [gtp]\\n[ 1010.716042]  __rtnl_newlink+0x1063/0x1700\\n[ 1010.716051]  ? rtnl_setlink+0x3c0/0x3c0\\n[ 1010.716063]  ? is_bpf_text_address+0xc0/0x1f0\\n[ 1010.716070]  ? kernel_text_address.part.0+0xbb/0xd0\\n[ 1010.716076]  ? __kernel_text_address+0x56/0xa0\\n[ 1010.716084]  ? unwind_get_return_address+0x5a/0xa0\\n[ 1010.716091]  ? create_prof_cpu_mask+0x30/0x30\\n[ 1010.716098]  ? arch_stack_walk+0x9e/0xf0\\n[ 1010.716106]  ? stack_trace_save+0x91/0xd0\\n[ 1010.716113]  ? stack_trace_consume_entry+0x170/0x170\\n[ 1010.716121]  ? __lock_acquire+0x15c5/0x5380\\n[ 1010.716139]  ? mark_held_locks+0x9e/0xe0\\n[ 1010.716148]  ? kmem_cache_alloc_trace+0x35f/0x3c0\\n[ 1010.716155]  ? __rtnl_newlink+0x1700/0x1700\\n[ 1010.716160]  rtnl_newlink+0x69/0xa0\\n[ 1010.716166]  rtnetlink_rcv_msg+0x43b/0xc50\\n[ 1010.716172]  ? rtnl_fdb_dump+0x9f0/0x9f0\\n[ 1010.716179]  ? lock_acquire+0x1fe/0x560\\n[ 1010.716188]  ? netlink_deliver_tap+0x12f/0xd50\\n[ 1010.716196]  netlink_rcv_skb+0x14d/0x440\\n[ 1010.716202]  ? rtnl_fdb_dump+0x9f0/0x9f0\\n[ 1010.716208]  ? netlink_ack+0xab0/0xab0\\n[ 1010.716213]  ? netlink_deliver_tap+0x202/0xd50\\n[ 1010.716220]  ? netlink_deliver_tap+0x218/0xd50\\n[ 1010.716226]  ? __virt_addr_valid+0x30b/0x590\\n[ 1010.716233]  netlink_unicast+0x54b/0x800\\n[ 1010.716240]  ? netlink_attachskb+0x870/0x870\\n[ 1010.716248]  ? __check_object_size+0x2de/0x3b0\\n[ 1010.716254]  netlink_sendmsg+0x938/0xe40\\n[ 1010.716261]  ? netlink_unicast+0x800/0x800\\n[ 1010.716269]  ? __import_iovec+0x292/0x510\\n[ 1010.716276]  ? netlink_unicast+0x800/0x800\\n[ 1010.716284]  __sock_sendmsg+0x159/0x190\\n[ 1010.716290]  ____sys_sendmsg+0x712/0x880\\n[ 1010.716297]  ? sock_write_iter+0x3d0/0x3d0\\n[ 1010.716304]  ? __ia32_sys_recvmmsg+0x270/0x270\\n[ 1010.716309]  ? lock_acquire+0x1fe/0x560\\n[ 1010.716315]  ? drain_array_locked+0x90/0x90\\n[ 1010.716324]  ___sys_sendmsg+0xf8/0x170\\n[ 1010.716331]  ? sendmsg_copy_msghdr+0x170/0x170\\n[ 1010.716337]  ? lockdep_init_map\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.309\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.271\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.212\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.151\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.81\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.21\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.9\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"4.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:27:17.339Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26793\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:27:17.339Z\", \"dateReserved\": \"2024-02-19T14:20:24.178Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-04T08:20:23.771Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}