GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-26809 (GCVE-0-2024-26809)

Vulnerability from cvelistv5 – Published: 2024-04-04 09:51 – Updated: 2026-08-05 11:27
VLAI
Title
netfilter: nft_set_pipapo: release elements in clone only from destroy path
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: release elements in clone only from destroy path Clone already always provides a current view of the lookup table, use it to destroy the set, otherwise it is possible to destroy elements twice. This fix requires: 212ed75dc5fb ("netfilter: nf_tables: integrate pipapo into commit protocol") which came after: 9827a0e6e23b ("netfilter: nft_set_pipapo: release elements in clone from abort path").
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:50 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4a6430b99f67842617c7208ca55a411e903ba03a , < b36b83297ff4910dfc8705402c8abffd4bbf8144 (git)
Affected: 5ccecafc728b0df48263d5ac198220bcd79830bc , < 362508506bf545e9ce18c72a2c48dcbfb891ab9c (git)
Affected: 9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e , < 5ad233dc731ab64cdc47b84a5c1f78fff6c024af (git)
Affected: 9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e , < ff90050771412b91e928093ccd8736ae680063c2 (git)
Affected: 9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e , < 821e28d5b506e6a73ccc367ff792bd894050d48b (git)
Affected: 9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e , < 9384b4d85c46ce839f51af01374062ce6318b2f2 (git)
Affected: 9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e , < b0e256f3dd2ba6532f37c5c22e07cb07a36031ee (git)
Affected: d2b18d110685ce46ca1633b8ec586c685e243a51 (git)
Affected: 5.10.130 , < 5.10.214 (semver)
Affected: 5.15.54 , < 5.15.153 (semver)
Affected: 5.18.11 , < 5.19 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 5.10.214 , ≤ 5.10.* (semver)
Unaffected: 5.15.153 , ≤ 5.15.* (semver)
Unaffected: 6.1.83 , ≤ 6.1.* (semver)
Unaffected: 6.6.23 , ≤ 6.6.* (semver)
Unaffected: 6.7.11 , ≤ 6.7.* (semver)
Unaffected: 6.8.2 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.546Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b36b83297ff4910dfc8705402c8abffd4bbf8144"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/362508506bf545e9ce18c72a2c48dcbfb891ab9c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5ad233dc731ab64cdc47b84a5c1f78fff6c024af"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ff90050771412b91e928093ccd8736ae680063c2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/821e28d5b506e6a73ccc367ff792bd894050d48b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9384b4d85c46ce839f51af01374062ce6318b2f2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b0e256f3dd2ba6532f37c5c22e07cb07a36031ee"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26809",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:50:40.137148Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:44.659Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_set_pipapo.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b36b83297ff4910dfc8705402c8abffd4bbf8144",
              "status": "affected",
              "version": "4a6430b99f67842617c7208ca55a411e903ba03a",
              "versionType": "git"
            },
            {
              "lessThan": "362508506bf545e9ce18c72a2c48dcbfb891ab9c",
              "status": "affected",
              "version": "5ccecafc728b0df48263d5ac198220bcd79830bc",
              "versionType": "git"
            },
            {
              "lessThan": "5ad233dc731ab64cdc47b84a5c1f78fff6c024af",
              "status": "affected",
              "version": "9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",
              "versionType": "git"
            },
            {
              "lessThan": "ff90050771412b91e928093ccd8736ae680063c2",
              "status": "affected",
              "version": "9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",
              "versionType": "git"
            },
            {
              "lessThan": "821e28d5b506e6a73ccc367ff792bd894050d48b",
              "status": "affected",
              "version": "9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",
              "versionType": "git"
            },
            {
              "lessThan": "9384b4d85c46ce839f51af01374062ce6318b2f2",
              "status": "affected",
              "version": "9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",
              "versionType": "git"
            },
            {
              "lessThan": "b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",
              "status": "affected",
              "version": "9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d2b18d110685ce46ca1633b8ec586c685e243a51",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.214",
              "status": "affected",
              "version": "5.10.130",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.153",
              "status": "affected",
              "version": "5.15.54",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19",
              "status": "affected",
              "version": "5.18.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_set_pipapo.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.214",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.214",
                  "versionStartIncluding": "5.10.130",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.153",
                  "versionStartIncluding": "5.15.54",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.83",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.23",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.11",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.2",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.18.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: release elements in clone only from destroy path\n\nClone already always provides a current view of the lookup table, use it\nto destroy the set, otherwise it is possible to destroy elements twice.\n\nThis fix requires:\n\n 212ed75dc5fb (\"netfilter: nf_tables: integrate pipapo into commit protocol\")\n\nwhich came after:\n\n 9827a0e6e23b (\"netfilter: nft_set_pipapo: release elements in clone from abort path\")."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached exclusively through the nfnetlink/nftables netlink socket (NFNL_SUBSYS_NFTABLES batch transactions), which requires local system access. There is no network-facing path into the pipapo set destroy code.\nAC:L - The double free is fully deterministic \u2014 a single netlink batch that modifies elements of a pipapo set and deletes that set in the same transaction leaves priv-\u003edirty set (nft_set_commit_update skips dead sets), guaranteeing elements are destroyed from both priv-\u003ematch and priv-\u003eclone. No race, no memory-layout precondition beyond ordinary attacker-controlled heap grooming.\nPR:L - nfnetlink_rcv_batch() checks netlink_net_capable(skb, CAP_NET_ADMIN), which is evaluated against the socket\u0027s network-namespace user namespace, so an unprivileged local user obtains it via unshare -Urn and can create tables, pipapo sets and elements freely. pipapo is compiled unconditionally into nf_tables and is the default backend for concatenated-range sets.\nUI:N - The attacker triggers the entire sequence themselves with one nftables transaction batch from their own process. No victim action or interaction of any kind is needed.\nS:U - The corruption occurs in kernel slab memory and is exploited to gain kernel privileges within the same security authority. No hypervisor, IOMMU, or other security-boundary crossing is involved.\nC:H - The double free of the element allocation yields a dangling reference to a reallocated slab object, letting the attacker read back kernel data (including data reclaimed into the same kmalloc-cg cache) and ultimately obtain an arbitrary-read primitive.\nI:H - A controlled double free of an attacker-sized, attacker-content object is a strong exploitation primitive: reclaiming the freed chunk with a second live allocation gives type confusion and an arbitrary-write path, compounded by the duplicated nft_set_elem_expr_destroy() dropping set/object reference counts twice and causing refcount underflow.\nA:H - Even without full exploitation, freeing the same nft_pipapo_elem twice corrupts slab freelists and double-destroys element expressions, producing immediate kernel oops/panic (or KASAN double-free BUG). The attacker can trigger it repeatedly and at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:27:28.080Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b36b83297ff4910dfc8705402c8abffd4bbf8144"
        },
        {
          "url": "https://git.kernel.org/stable/c/362508506bf545e9ce18c72a2c48dcbfb891ab9c"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ad233dc731ab64cdc47b84a5c1f78fff6c024af"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff90050771412b91e928093ccd8736ae680063c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/821e28d5b506e6a73ccc367ff792bd894050d48b"
        },
        {
          "url": "https://git.kernel.org/stable/c/9384b4d85c46ce839f51af01374062ce6318b2f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0e256f3dd2ba6532f37c5c22e07cb07a36031ee"
        }
      ],
      "title": "netfilter: nft_set_pipapo: release elements in clone only from destroy path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26809",
    "datePublished": "2024-04-04T09:51:51.245Z",
    "dateReserved": "2024-02-19T14:20:24.179Z",
    "dateUpdated": "2026-08-05T11:27:28.080Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26809",
      "date": "2026-09-16",
      "epss": "0.00294",
      "percentile": "0.22059"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nft_set_pipapo: release elements in clone only from destroy path\\n\\nClone already always provides a current view of the lookup table, use it\\nto destroy the set, otherwise it is possible to destroy elements twice.\\n\\nThis fix requires:\\n\\n 212ed75dc5fb (\\\"netfilter: nf_tables: integrate pipapo into commit protocol\\\")\\n\\nwhich came after:\\n\\n 9827a0e6e23b (\\\"netfilter: nft_set_pipapo: release elements in clone from abort path\\\").\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nft_set_pipapo: libera elementos en el clon solo desde la ruta de destrucci\\u00f3n. El clon ya siempre proporciona una vista actual de la tabla de b\\u00fasqueda, \\u00fasala para destruir el conjunto; de lo contrario, es posible destruir elementos. dos veces. Esta soluci\\u00f3n requiere: 212ed75dc5fb (\\\"netfilter: nf_tables: integrar pipapo en el protocolo de confirmaci\\u00f3n\\\") que vino despu\\u00e9s: 9827a0e6e23b (\\\"netfilter: nft_set_pipapo: liberar elementos en clon desde la ruta de cancelaci\\u00f3n\\\").\"}]",
      "id": "CVE-2024-26809",
      "lastModified": "2024-11-21T09:03:07.470",
      "published": "2024-04-04T10:15:09.820",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/362508506bf545e9ce18c72a2c48dcbfb891ab9c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/5ad233dc731ab64cdc47b84a5c1f78fff6c024af\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/821e28d5b506e6a73ccc367ff792bd894050d48b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/9384b4d85c46ce839f51af01374062ce6318b2f2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/b0e256f3dd2ba6532f37c5c22e07cb07a36031ee\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/b36b83297ff4910dfc8705402c8abffd4bbf8144\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ff90050771412b91e928093ccd8736ae680063c2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/362508506bf545e9ce18c72a2c48dcbfb891ab9c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/5ad233dc731ab64cdc47b84a5c1f78fff6c024af\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/821e28d5b506e6a73ccc367ff792bd894050d48b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/9384b4d85c46ce839f51af01374062ce6318b2f2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/b0e256f3dd2ba6532f37c5c22e07cb07a36031ee\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/b36b83297ff4910dfc8705402c8abffd4bbf8144\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/ff90050771412b91e928093ccd8736ae680063c2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26809\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-04T10:15:09.820\",\"lastModified\":\"2026-08-04T11:17:08.603\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nft_set_pipapo: release elements in clone only from destroy path\\n\\nClone already always provides a current view of the lookup table, use it\\nto destroy the set, otherwise it is possible to destroy elements twice.\\n\\nThis fix requires:\\n\\n 212ed75dc5fb (\\\"netfilter: nf_tables: integrate pipapo into commit protocol\\\")\\n\\nwhich came after:\\n\\n 9827a0e6e23b (\\\"netfilter: nft_set_pipapo: release elements in clone from abort path\\\").\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nft_set_pipapo: libera elementos en el clon solo desde la ruta de destrucci\u00f3n. El clon ya siempre proporciona una vista actual de la tabla de b\u00fasqueda, \u00fasala para destruir el conjunto; de lo contrario, es posible destruir elementos. dos veces. Esta soluci\u00f3n requiere: 212ed75dc5fb (\\\"netfilter: nf_tables: integrar pipapo en el protocolo de confirmaci\u00f3n\\\") que vino despu\u00e9s: 9827a0e6e23b (\\\"netfilter: nft_set_pipapo: liberar elementos en clon desde la ruta de cancelaci\u00f3n\\\").\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/netfilter/nft_set_pipapo.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4a6430b99f67842617c7208ca55a411e903ba03a\",\"lessThan\":\"b36b83297ff4910dfc8705402c8abffd4bbf8144\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5ccecafc728b0df48263d5ac198220bcd79830bc\",\"lessThan\":\"362508506bf545e9ce18c72a2c48dcbfb891ab9c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e\",\"lessThan\":\"5ad233dc731ab64cdc47b84a5c1f78fff6c024af\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e\",\"lessThan\":\"ff90050771412b91e928093ccd8736ae680063c2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e\",\"lessThan\":\"821e28d5b506e6a73ccc367ff792bd894050d48b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e\",\"lessThan\":\"9384b4d85c46ce839f51af01374062ce6318b2f2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e\",\"lessThan\":\"b0e256f3dd2ba6532f37c5c22e07cb07a36031ee\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d2b18d110685ce46ca1633b8ec586c685e243a51\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.130\",\"lessThan\":\"5.10.214\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.54\",\"lessThan\":\"5.15.153\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.18.11\",\"lessThan\":\"5.19\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/netfilter/nft_set_pipapo.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.214\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.153\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.83\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.23\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.11\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.2\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T15:50:40.137148Z\",\"id\":\"CVE-2024-26809\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.130\",\"versionEndExcluding\":\"5.10.214\",\"matchCriteriaId\":\"22B07DEF-9858-4D7B-ACDE-078D5421F0D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.54\",\"versionEndExcluding\":\"5.15.153\",\"matchCriteriaId\":\"9C0EF0BE-4A28-471E-B665-E3CB7A66436C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18.11\",\"versionEndExcluding\":\"6.1.83\",\"matchCriteriaId\":\"2C0C1B61-8338-4B49-BB56-B33CD1C6BA3A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.23\",\"matchCriteriaId\":\"E00814DC-0BA7-431A-9926-80FEB4A96C68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.11\",\"matchCriteriaId\":\"9B95D3A6-E162-47D5-ABFC-F3FA74FA7CFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.8.2\",\"matchCriteriaId\":\"543A75FF-25B8-4046-A514-1EA8EDD87AB1\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/362508506bf545e9ce18c72a2c48dcbfb891ab9c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5ad233dc731ab64cdc47b84a5c1f78fff6c024af\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/821e28d5b506e6a73ccc367ff792bd894050d48b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9384b4d85c46ce839f51af01374062ce6318b2f2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b0e256f3dd2ba6532f37c5c22e07cb07a36031ee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b36b83297ff4910dfc8705402c8abffd4bbf8144\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ff90050771412b91e928093ccd8736ae680063c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/362508506bf545e9ce18c72a2c48dcbfb891ab9c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5ad233dc731ab64cdc47b84a5c1f78fff6c024af\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/821e28d5b506e6a73ccc367ff792bd894050d48b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9384b4d85c46ce839f51af01374062ce6318b2f2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b0e256f3dd2ba6532f37c5c22e07cb07a36031ee\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b36b83297ff4910dfc8705402c8abffd4bbf8144\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ff90050771412b91e928093ccd8736ae680063c2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:11:26+00:00",
      "cve": "CVE-2024-26809",
      "id": "CVE-2024-26809",
      "initial_release_date": "2024-04-04T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: nft_set_pipapo: release elements in clone only from destroy path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26809.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-03T16:43:45Z",
      "cve": "CVE-2024-26809",
      "id": "CVE-2024-26809",
      "initial_release_date": "2024-04-11T02:30:54Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "397",
      "product_status:recommended": "359",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26809",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26809.json",
      "version": "93"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b36b83297ff4910dfc8705402c8abffd4bbf8144\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/362508506bf545e9ce18c72a2c48dcbfb891ab9c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5ad233dc731ab64cdc47b84a5c1f78fff6c024af\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ff90050771412b91e928093ccd8736ae680063c2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/821e28d5b506e6a73ccc367ff792bd894050d48b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9384b4d85c46ce839f51af01374062ce6318b2f2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b0e256f3dd2ba6532f37c5c22e07cb07a36031ee\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.546Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26809\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:50:40.137148Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:18.457Z\"}}], \"cna\": {\"title\": \"netfilter: nft_set_pipapo: release elements in clone only from destroy path\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerability is reached exclusively through the nfnetlink/nftables netlink socket (NFNL_SUBSYS_NFTABLES batch transactions), which requires local system access. There is no network-facing path into the pipapo set destroy code.\\nAC:L - The double free is fully deterministic \\u2014 a single netlink batch that modifies elements of a pipapo set and deletes that set in the same transaction leaves priv-\u003edirty set (nft_set_commit_update skips dead sets), guaranteeing elements are destroyed from both priv-\u003ematch and priv-\u003eclone. No race, no memory-layout precondition beyond ordinary attacker-controlled heap grooming.\\nPR:L - nfnetlink_rcv_batch() checks netlink_net_capable(skb, CAP_NET_ADMIN), which is evaluated against the socket\u0027s network-namespace user namespace, so an unprivileged local user obtains it via unshare -Urn and can create tables, pipapo sets and elements freely. pipapo is compiled unconditionally into nf_tables and is the default backend for concatenated-range sets.\\nUI:N - The attacker triggers the entire sequence themselves with one nftables transaction batch from their own process. No victim action or interaction of any kind is needed.\\nS:U - The corruption occurs in kernel slab memory and is exploited to gain kernel privileges within the same security authority. No hypervisor, IOMMU, or other security-boundary crossing is involved.\\nC:H - The double free of the element allocation yields a dangling reference to a reallocated slab object, letting the attacker read back kernel data (including data reclaimed into the same kmalloc-cg cache) and ultimately obtain an arbitrary-read primitive.\\nI:H - A controlled double free of an attacker-sized, attacker-content object is a strong exploitation primitive: reclaiming the freed chunk with a second live allocation gives type confusion and an arbitrary-write path, compounded by the duplicated nft_set_elem_expr_destroy() dropping set/object reference counts twice and causing refcount underflow.\\nA:H - Even without full exploitation, freeing the same nft_pipapo_elem twice corrupts slab freelists and double-destroys element expressions, producing immediate kernel oops/panic (or KASAN double-free BUG). The attacker can trigger it repeatedly and at will.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4a6430b99f67842617c7208ca55a411e903ba03a\", \"lessThan\": \"b36b83297ff4910dfc8705402c8abffd4bbf8144\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5ccecafc728b0df48263d5ac198220bcd79830bc\", \"lessThan\": \"362508506bf545e9ce18c72a2c48dcbfb891ab9c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e\", \"lessThan\": \"5ad233dc731ab64cdc47b84a5c1f78fff6c024af\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e\", \"lessThan\": \"ff90050771412b91e928093ccd8736ae680063c2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e\", \"lessThan\": \"821e28d5b506e6a73ccc367ff792bd894050d48b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e\", \"lessThan\": \"9384b4d85c46ce839f51af01374062ce6318b2f2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e\", \"lessThan\": \"b0e256f3dd2ba6532f37c5c22e07cb07a36031ee\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d2b18d110685ce46ca1633b8ec586c685e243a51\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.10.130\", \"lessThan\": \"5.10.214\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.15.54\", \"lessThan\": \"5.15.153\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.18.11\", \"lessThan\": \"5.19\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/netfilter/nft_set_pipapo.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.19\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.19\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.214\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.153\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.83\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.23\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/netfilter/nft_set_pipapo.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b36b83297ff4910dfc8705402c8abffd4bbf8144\"}, {\"url\": \"https://git.kernel.org/stable/c/362508506bf545e9ce18c72a2c48dcbfb891ab9c\"}, {\"url\": \"https://git.kernel.org/stable/c/5ad233dc731ab64cdc47b84a5c1f78fff6c024af\"}, {\"url\": \"https://git.kernel.org/stable/c/ff90050771412b91e928093ccd8736ae680063c2\"}, {\"url\": \"https://git.kernel.org/stable/c/821e28d5b506e6a73ccc367ff792bd894050d48b\"}, {\"url\": \"https://git.kernel.org/stable/c/9384b4d85c46ce839f51af01374062ce6318b2f2\"}, {\"url\": \"https://git.kernel.org/stable/c/b0e256f3dd2ba6532f37c5c22e07cb07a36031ee\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nft_set_pipapo: release elements in clone only from destroy path\\n\\nClone already always provides a current view of the lookup table, use it\\nto destroy the set, otherwise it is possible to destroy elements twice.\\n\\nThis fix requires:\\n\\n 212ed75dc5fb (\\\"netfilter: nf_tables: integrate pipapo into commit protocol\\\")\\n\\nwhich came after:\\n\\n 9827a0e6e23b (\\\"netfilter: nft_set_pipapo: release elements in clone from abort path\\\").\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.214\", \"versionStartIncluding\": \"5.10.130\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.153\", \"versionStartIncluding\": \"5.15.54\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.83\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.23\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.11\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.2\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.18.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:27:28.080Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26809\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:27:28.080Z\", \"dateReserved\": \"2024-02-19T14:20:24.179Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-04T09:51:51.245Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.