CVE-2024-26834 (GCVE-0-2024-26834)

Vulnerability from cvelistv5 – Published: 2024-04-17 10:10 – Updated: 2026-08-05 11:27
VLAI
Title
netfilter: nft_flow_offload: release dst in case direct xmit path is used
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_flow_offload: release dst in case direct xmit path is used Direct xmit does not use it since it calls dev_queue_xmit() to send packets, hence it calls dst_release(). kmemleak reports: unreferenced object 0xffff88814f440900 (size 184): comm "softirq", pid 0, jiffies 4294951896 hex dump (first 32 bytes): 00 60 5b 04 81 88 ff ff 00 e6 e8 82 ff ff ff ff .`[............. 21 0b 50 82 ff ff ff ff 00 00 00 00 00 00 00 00 !.P............. backtrace (crc cb2bf5d6): [<000000003ee17107>] kmem_cache_alloc+0x286/0x340 [<0000000021a5de2c>] dst_alloc+0x43/0xb0 [<00000000f0671159>] rt_dst_alloc+0x2e/0x190 [<00000000fe5092c9>] __mkroute_output+0x244/0x980 [<000000005fb96fb0>] ip_route_output_flow+0xc0/0x160 [<0000000045367433>] nf_ip_route+0xf/0x30 [<0000000085da1d8e>] nf_route+0x2d/0x60 [<00000000d1ecd1cb>] nft_flow_route+0x171/0x6a0 [nft_flow_offload] [<00000000d9b2fb60>] nft_flow_offload_eval+0x4e8/0x700 [nft_flow_offload] [<000000009f447dbb>] expr_call_ops_eval+0x53/0x330 [nf_tables] [<00000000072e1be6>] nft_do_chain+0x17c/0x840 [nf_tables] [<00000000d0551029>] nft_do_chain_inet+0xa1/0x210 [nf_tables] [<0000000097c9d5c6>] nf_hook_slow+0x5b/0x160 [<0000000005eccab1>] ip_forward+0x8b6/0x9b0 [<00000000553a269b>] ip_rcv+0x221/0x230 [<00000000412872e5>] __netif_receive_skb_one_core+0xfe/0x110
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 7c71b831220edeab7ce603d818dc1708d9ea4137 , < 13b57b5cd591d5b22f9bbf047b2922967de411f3 (git)
Affected: 9c5662e95a8dcc232c3ef4deb21033badcd260f6 , < a6cafdb49a7bbf4a88367db209703eee6941e023 (git)
Affected: fa502c86566680ac62bc28ec883a069bf7a2aa5e , < 9256ab9232e35a16af9c30fa4e522e6d1bd3605a (git)
Affected: fa502c86566680ac62bc28ec883a069bf7a2aa5e , < 2d17cf10179a7de6d8f0128168b84ad0b4a1863f (git)
Affected: fa502c86566680ac62bc28ec883a069bf7a2aa5e , < 8762785f459be1cfe6fcf7285c123aad6a3703f0 (git)
Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.6.19 , ≤ 6.6.* (semver)
Unaffected: 6.7.7 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26834",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:41:37.747801Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T17:48:34.642Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.630Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/13b57b5cd591d5b22f9bbf047b2922967de411f3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a6cafdb49a7bbf4a88367db209703eee6941e023"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9256ab9232e35a16af9c30fa4e522e6d1bd3605a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2d17cf10179a7de6d8f0128168b84ad0b4a1863f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8762785f459be1cfe6fcf7285c123aad6a3703f0"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_flow_table_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "13b57b5cd591d5b22f9bbf047b2922967de411f3",
              "status": "affected",
              "version": "7c71b831220edeab7ce603d818dc1708d9ea4137",
              "versionType": "git"
            },
            {
              "lessThan": "a6cafdb49a7bbf4a88367db209703eee6941e023",
              "status": "affected",
              "version": "9c5662e95a8dcc232c3ef4deb21033badcd260f6",
              "versionType": "git"
            },
            {
              "lessThan": "9256ab9232e35a16af9c30fa4e522e6d1bd3605a",
              "status": "affected",
              "version": "fa502c86566680ac62bc28ec883a069bf7a2aa5e",
              "versionType": "git"
            },
            {
              "lessThan": "2d17cf10179a7de6d8f0128168b84ad0b4a1863f",
              "status": "affected",
              "version": "fa502c86566680ac62bc28ec883a069bf7a2aa5e",
              "versionType": "git"
            },
            {
              "lessThan": "8762785f459be1cfe6fcf7285c123aad6a3703f0",
              "status": "affected",
              "version": "fa502c86566680ac62bc28ec883a069bf7a2aa5e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_flow_table_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.19",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.7",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_flow_offload: release dst in case direct xmit path is used\n\nDirect xmit does not use it since it calls dev_queue_xmit() to send\npackets, hence it calls dst_release().\n\nkmemleak reports:\n\nunreferenced object 0xffff88814f440900 (size 184):\n  comm \"softirq\", pid 0, jiffies 4294951896\n  hex dump (first 32 bytes):\n    00 60 5b 04 81 88 ff ff 00 e6 e8 82 ff ff ff ff  .`[.............\n    21 0b 50 82 ff ff ff ff 00 00 00 00 00 00 00 00  !.P.............\n  backtrace (crc cb2bf5d6):\n    [\u003c000000003ee17107\u003e] kmem_cache_alloc+0x286/0x340\n    [\u003c0000000021a5de2c\u003e] dst_alloc+0x43/0xb0\n    [\u003c00000000f0671159\u003e] rt_dst_alloc+0x2e/0x190\n    [\u003c00000000fe5092c9\u003e] __mkroute_output+0x244/0x980\n    [\u003c000000005fb96fb0\u003e] ip_route_output_flow+0xc0/0x160\n    [\u003c0000000045367433\u003e] nf_ip_route+0xf/0x30\n    [\u003c0000000085da1d8e\u003e] nf_route+0x2d/0x60\n    [\u003c00000000d1ecd1cb\u003e] nft_flow_route+0x171/0x6a0 [nft_flow_offload]\n    [\u003c00000000d9b2fb60\u003e] nft_flow_offload_eval+0x4e8/0x700 [nft_flow_offload]\n    [\u003c000000009f447dbb\u003e] expr_call_ops_eval+0x53/0x330 [nf_tables]\n    [\u003c00000000072e1be6\u003e] nft_do_chain+0x17c/0x840 [nf_tables]\n    [\u003c00000000d0551029\u003e] nft_do_chain_inet+0xa1/0x210 [nf_tables]\n    [\u003c0000000097c9d5c6\u003e] nf_hook_slow+0x5b/0x160\n    [\u003c0000000005eccab1\u003e] ip_forward+0x8b6/0x9b0\n    [\u003c00000000553a269b\u003e] ip_rcv+0x221/0x230\n    [\u003c00000000412872e5\u003e] __netif_receive_skb_one_core+0xfe/0x110"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The expression is only valid on the `NF_INET_FORWARD` hook, so the leak is driven entirely by packets transiting the router \u2014 `ip_rcv` \u2192 `ip_forward` \u2192 `nft_do_chain` \u2192 `nft_flow_offload_eval`, exactly the kmemleak backtrace. Any remote host whose TCP/UDP traffic is routed through the box (port-forwarded service, DMZ host, or ordinary transit flow) triggers it, with no L2 adjacency required.\nAC:L - In the vulnerable configuration the leak is deterministic \u2014 every offloaded flow whose path resolves to `FLOW_OFFLOAD_XMIT_DIRECT` leaks its dst with no race, timing window, or memory-layout precondition, and the attacker controls the flow-creation rate by simply opening connections. The bridge-in-path and hardware-offload conditions that select direct xmit are the normal OpenWrt/consumer-router flowtable deployment, not a rare configuration.\nPR:N - Sending packets through a forwarding router requires no credentials, authentication, or account on the target; the conntrack entry and flow offload are created purely as a side effect of transit traffic. No privilege check exists anywhere between `netif_receive_skb` and `flow_offload_fill_route`.\nUI:N - The attacker\u0027s own packets drive the entire path; no administrator or user of the router needs to open a file, mount anything, or take any action for the leak to accumulate.\nS:U - The leaked `struct rtable` objects and the exhausted slab belong to the same kernel that contains the flawed code, and no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is a missing reference drop, so nothing is freed early, read out of bounds, or copied out \u2014 the orphaned dst is simply unreachable and no kernel data reaches userspace or any remote peer.\nI:N - An over-reference is the safe direction: no object is freed prematurely, overwritten, or type-confused, giving no write primitive and no influence over control flow. The offloaded flow itself continues to function correctly because direct xmit never needed the dst.\nA:H - The leak is unbounded and its rate is limited only by the unauthenticated attacker\u0027s packet rate \u2014 two packets per unique tuple permanently orphan up to two 184-byte `ip_dst_cache` objects, and neither conntrack expiry nor `nf_conntrack_max` reclaims them, so sustained transit traffic drives the router to memory exhaustion, OOM kill, and loss of forwarding. On IPv6 the inflated `dst_entries` count additionally keeps `fib6_run_gc()` permanently engaged and collapses `ip6_rt_gc_expire`, prematurely expiring legitimate routes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:27:43.870Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/13b57b5cd591d5b22f9bbf047b2922967de411f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6cafdb49a7bbf4a88367db209703eee6941e023"
        },
        {
          "url": "https://git.kernel.org/stable/c/9256ab9232e35a16af9c30fa4e522e6d1bd3605a"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d17cf10179a7de6d8f0128168b84ad0b4a1863f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8762785f459be1cfe6fcf7285c123aad6a3703f0"
        }
      ],
      "title": "netfilter: nft_flow_offload: release dst in case direct xmit path is used",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26834",
    "datePublished": "2024-04-17T10:10:02.282Z",
    "dateReserved": "2024-02-19T14:20:24.181Z",
    "dateUpdated": "2026-08-05T11:27:43.870Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26834",
      "date": "2026-08-07",
      "epss": "0.00598",
      "percentile": "0.45381"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nft_flow_offload: release dst in case direct xmit path is used\\n\\nDirect xmit does not use it since it calls dev_queue_xmit() to send\\npackets, hence it calls dst_release().\\n\\nkmemleak reports:\\n\\nunreferenced object 0xffff88814f440900 (size 184):\\n  comm \\\"softirq\\\", pid 0, jiffies 4294951896\\n  hex dump (first 32 bytes):\\n    00 60 5b 04 81 88 ff ff 00 e6 e8 82 ff ff ff ff  .`[.............\\n    21 0b 50 82 ff ff ff ff 00 00 00 00 00 00 00 00  !.P.............\\n  backtrace (crc cb2bf5d6):\\n    [\u003c000000003ee17107\u003e] kmem_cache_alloc+0x286/0x340\\n    [\u003c0000000021a5de2c\u003e] dst_alloc+0x43/0xb0\\n    [\u003c00000000f0671159\u003e] rt_dst_alloc+0x2e/0x190\\n    [\u003c00000000fe5092c9\u003e] __mkroute_output+0x244/0x980\\n    [\u003c000000005fb96fb0\u003e] ip_route_output_flow+0xc0/0x160\\n    [\u003c0000000045367433\u003e] nf_ip_route+0xf/0x30\\n    [\u003c0000000085da1d8e\u003e] nf_route+0x2d/0x60\\n    [\u003c00000000d1ecd1cb\u003e] nft_flow_route+0x171/0x6a0 [nft_flow_offload]\\n    [\u003c00000000d9b2fb60\u003e] nft_flow_offload_eval+0x4e8/0x700 [nft_flow_offload]\\n    [\u003c000000009f447dbb\u003e] expr_call_ops_eval+0x53/0x330 [nf_tables]\\n    [\u003c00000000072e1be6\u003e] nft_do_chain+0x17c/0x840 [nf_tables]\\n    [\u003c00000000d0551029\u003e] nft_do_chain_inet+0xa1/0x210 [nf_tables]\\n    [\u003c0000000097c9d5c6\u003e] nf_hook_slow+0x5b/0x160\\n    [\u003c0000000005eccab1\u003e] ip_forward+0x8b6/0x9b0\\n    [\u003c00000000553a269b\u003e] ip_rcv+0x221/0x230\\n    [\u003c00000000412872e5\u003e] __netif_receive_skb_one_core+0xfe/0x110\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nft_flow_offload: libera dst en caso de que se use la ruta de xmit directa Direct xmit no la usa ya que llama a dev_queue_xmit() para enviar paquetes, por lo tanto llama a dst_release(). informes kmemleak: objeto sin referencia 0xffff88814f440900 (tama\\u00f1o 184): comm \\\"softirq\\\", pid 0, jiffies 4294951896 volcado hexadecimal (primeros 32 bytes): 00 60 5b 04 81 88 ff ff 00 e6 e8 82 ff ff ff ff .`[.. ........... 21 0b 50 82 ff ff ff ff 00 00 00 00 00 00 00 00 !.P................. retroceso (crc cb2bf5d6): [ \u0026lt;000000003ee17107\u0026gt;] kmem_cache_alloc+0x286/0x340 [\u0026lt;0000000021a5de2c\u0026gt;] dst_alloc+0x43/0xb0 [\u0026lt;00000000f0671159\u0026gt;] rt_dst_alloc+0x2e/0x190 [\u0026lt;00000000fe50 92c9\u0026gt;] __mkroute_output+0x244/0x980 [\u0026lt;000000005fb96fb0\u0026gt;] ip_route_output_flow+0xc0/0x160 [ \u0026lt;0000000045367433\u0026gt;] nf_ip_route+0xf/0x30 [\u0026lt;0000000085da1d8e\u0026gt;] nf_route+0x2d/0x60 [\u0026lt;00000000d1ecd1cb\u0026gt;] nft_flow_route+0x171/0x6a0 [nft_flow_offload] 0000d9b2fb60\u0026gt;] nft_flow_offload_eval+0x4e8/0x700 [nft_flow_offload] [\u0026lt;000000009f447dbb\u0026gt;] expr_call_ops_eval+0x53/0x330 [nf_tables] [\u0026lt;00000000072e1be6\u0026gt;] nft_do_chain+0x17c/0x840 [nf_tables] [\u0026lt;00000000d0551029\u0026gt;] nft_do_chain_inet+0xa1/0x210 [nf_tables] [ \u0026lt;0000000097c9d5c6\u0026gt;] nf_hook_slow+0x5b/0x160 [\u0026lt;0000000005eccab1\u0026gt;] ip_forward +0x8b6/0x9b0 [\u0026lt;00000000553a269b\u0026gt;] ip_rcv+0x221/0x230 [\u0026lt;00000000412872e5\u0026gt;] __netif_receive_skb_one_core+0xfe/0x110\"}]",
      "id": "CVE-2024-26834",
      "lastModified": "2024-11-21T09:03:10.360",
      "published": "2024-04-17T10:15:09.617",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/13b57b5cd591d5b22f9bbf047b2922967de411f3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/2d17cf10179a7de6d8f0128168b84ad0b4a1863f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/8762785f459be1cfe6fcf7285c123aad6a3703f0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/9256ab9232e35a16af9c30fa4e522e6d1bd3605a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a6cafdb49a7bbf4a88367db209703eee6941e023\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/13b57b5cd591d5b22f9bbf047b2922967de411f3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/2d17cf10179a7de6d8f0128168b84ad0b4a1863f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/8762785f459be1cfe6fcf7285c123aad6a3703f0\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/9256ab9232e35a16af9c30fa4e522e6d1bd3605a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/a6cafdb49a7bbf4a88367db209703eee6941e023\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26834\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-17T10:15:09.617\",\"lastModified\":\"2026-08-04T11:17:12.010\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nft_flow_offload: release dst in case direct xmit path is used\\n\\nDirect xmit does not use it since it calls dev_queue_xmit() to send\\npackets, hence it calls dst_release().\\n\\nkmemleak reports:\\n\\nunreferenced object 0xffff88814f440900 (size 184):\\n  comm \\\"softirq\\\", pid 0, jiffies 4294951896\\n  hex dump (first 32 bytes):\\n    00 60 5b 04 81 88 ff ff 00 e6 e8 82 ff ff ff ff  .`[.............\\n    21 0b 50 82 ff ff ff ff 00 00 00 00 00 00 00 00  !.P.............\\n  backtrace (crc cb2bf5d6):\\n    [\u003c000000003ee17107\u003e] kmem_cache_alloc+0x286/0x340\\n    [\u003c0000000021a5de2c\u003e] dst_alloc+0x43/0xb0\\n    [\u003c00000000f0671159\u003e] rt_dst_alloc+0x2e/0x190\\n    [\u003c00000000fe5092c9\u003e] __mkroute_output+0x244/0x980\\n    [\u003c000000005fb96fb0\u003e] ip_route_output_flow+0xc0/0x160\\n    [\u003c0000000045367433\u003e] nf_ip_route+0xf/0x30\\n    [\u003c0000000085da1d8e\u003e] nf_route+0x2d/0x60\\n    [\u003c00000000d1ecd1cb\u003e] nft_flow_route+0x171/0x6a0 [nft_flow_offload]\\n    [\u003c00000000d9b2fb60\u003e] nft_flow_offload_eval+0x4e8/0x700 [nft_flow_offload]\\n    [\u003c000000009f447dbb\u003e] expr_call_ops_eval+0x53/0x330 [nf_tables]\\n    [\u003c00000000072e1be6\u003e] nft_do_chain+0x17c/0x840 [nf_tables]\\n    [\u003c00000000d0551029\u003e] nft_do_chain_inet+0xa1/0x210 [nf_tables]\\n    [\u003c0000000097c9d5c6\u003e] nf_hook_slow+0x5b/0x160\\n    [\u003c0000000005eccab1\u003e] ip_forward+0x8b6/0x9b0\\n    [\u003c00000000553a269b\u003e] ip_rcv+0x221/0x230\\n    [\u003c00000000412872e5\u003e] __netif_receive_skb_one_core+0xfe/0x110\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nft_flow_offload: libera dst en caso de que se use la ruta de xmit directa Direct xmit no la usa ya que llama a dev_queue_xmit() para enviar paquetes, por lo tanto llama a dst_release(). informes kmemleak: objeto sin referencia 0xffff88814f440900 (tama\u00f1o 184): comm \\\"softirq\\\", pid 0, jiffies 4294951896 volcado hexadecimal (primeros 32 bytes): 00 60 5b 04 81 88 ff ff 00 e6 e8 82 ff ff ff ff .`[.. ........... 21 0b 50 82 ff ff ff ff 00 00 00 00 00 00 00 00 !.P................. retroceso (crc cb2bf5d6): [ \u0026lt;000000003ee17107\u0026gt;] kmem_cache_alloc+0x286/0x340 [\u0026lt;0000000021a5de2c\u0026gt;] dst_alloc+0x43/0xb0 [\u0026lt;00000000f0671159\u0026gt;] rt_dst_alloc+0x2e/0x190 [\u0026lt;00000000fe50 92c9\u0026gt;] __mkroute_output+0x244/0x980 [\u0026lt;000000005fb96fb0\u0026gt;] ip_route_output_flow+0xc0/0x160 [ \u0026lt;0000000045367433\u0026gt;] nf_ip_route+0xf/0x30 [\u0026lt;0000000085da1d8e\u0026gt;] nf_route+0x2d/0x60 [\u0026lt;00000000d1ecd1cb\u0026gt;] nft_flow_route+0x171/0x6a0 [nft_flow_offload] 0000d9b2fb60\u0026gt;] nft_flow_offload_eval+0x4e8/0x700 [nft_flow_offload] [\u0026lt;000000009f447dbb\u0026gt;] expr_call_ops_eval+0x53/0x330 [nf_tables] [\u0026lt;00000000072e1be6\u0026gt;] nft_do_chain+0x17c/0x840 [nf_tables] [\u0026lt;00000000d0551029\u0026gt;] nft_do_chain_inet+0xa1/0x210 [nf_tables] [ \u0026lt;0000000097c9d5c6\u0026gt;] nf_hook_slow+0x5b/0x160 [\u0026lt;0000000005eccab1\u0026gt;] ip_forward +0x8b6/0x9b0 [\u0026lt;00000000553a269b\u0026gt;] ip_rcv+0x221/0x230 [\u0026lt;00000000412872e5\u0026gt;] __netif_receive_skb_one_core+0xfe/0x110\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/netfilter/nf_flow_table_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7c71b831220edeab7ce603d818dc1708d9ea4137\",\"lessThan\":\"13b57b5cd591d5b22f9bbf047b2922967de411f3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9c5662e95a8dcc232c3ef4deb21033badcd260f6\",\"lessThan\":\"a6cafdb49a7bbf4a88367db209703eee6941e023\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fa502c86566680ac62bc28ec883a069bf7a2aa5e\",\"lessThan\":\"9256ab9232e35a16af9c30fa4e522e6d1bd3605a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fa502c86566680ac62bc28ec883a069bf7a2aa5e\",\"lessThan\":\"2d17cf10179a7de6d8f0128168b84ad0b4a1863f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fa502c86566680ac62bc28ec883a069bf7a2aa5e\",\"lessThan\":\"8762785f459be1cfe6fcf7285c123aad6a3703f0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/netfilter/nf_flow_table_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.19\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.7\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-17T17:41:37.747801Z\",\"id\":\"CVE-2024-26834\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5\",\"versionEndExcluding\":\"6.6.19\",\"matchCriteriaId\":\"A0B51637-34FC-474F-8640-2361C61E7DD2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.7\",\"matchCriteriaId\":\"575EE16B-67F2-4B5B-B5F8-1877715C898B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"A780F817-2A77-4130-A9B7-5C25606314E3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/13b57b5cd591d5b22f9bbf047b2922967de411f3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2d17cf10179a7de6d8f0128168b84ad0b4a1863f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8762785f459be1cfe6fcf7285c123aad6a3703f0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9256ab9232e35a16af9c30fa4e522e6d1bd3605a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a6cafdb49a7bbf4a88367db209703eee6941e023\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/13b57b5cd591d5b22f9bbf047b2922967de411f3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2d17cf10179a7de6d8f0128168b84ad0b4a1863f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8762785f459be1cfe6fcf7285c123aad6a3703f0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9256ab9232e35a16af9c30fa4e522e6d1bd3605a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a6cafdb49a7bbf4a88367db209703eee6941e023\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:51:02+00:00",
      "cve": "CVE-2024-26834",
      "id": "CVE-2024-26834",
      "initial_release_date": "2024-04-17T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: nft_flow_offload: release dst in case direct xmit path is used",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26834.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-07-25T01:55:44Z",
      "cve": "CVE-2024-26834",
      "id": "CVE-2024-26834",
      "initial_release_date": "2024-04-18T02:30:14Z",
      "product_status:known_not_affected": "311",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26834",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26834.json",
      "version": "18"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/13b57b5cd591d5b22f9bbf047b2922967de411f3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a6cafdb49a7bbf4a88367db209703eee6941e023\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9256ab9232e35a16af9c30fa4e522e6d1bd3605a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2d17cf10179a7de6d8f0128168b84ad0b4a1863f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8762785f459be1cfe6fcf7285c123aad6a3703f0\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.630Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26834\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-17T17:41:37.747801Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-17T17:41:38.743Z\"}}], \"cna\": {\"title\": \"netfilter: nft_flow_offload: release dst in case direct xmit path is used\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The expression is only valid on the `NF_INET_FORWARD` hook, so the leak is driven entirely by packets transiting the router \\u2014 `ip_rcv` \\u2192 `ip_forward` \\u2192 `nft_do_chain` \\u2192 `nft_flow_offload_eval`, exactly the kmemleak backtrace. Any remote host whose TCP/UDP traffic is routed through the box (port-forwarded service, DMZ host, or ordinary transit flow) triggers it, with no L2 adjacency required.\\nAC:L - In the vulnerable configuration the leak is deterministic \\u2014 every offloaded flow whose path resolves to `FLOW_OFFLOAD_XMIT_DIRECT` leaks its dst with no race, timing window, or memory-layout precondition, and the attacker controls the flow-creation rate by simply opening connections. The bridge-in-path and hardware-offload conditions that select direct xmit are the normal OpenWrt/consumer-router flowtable deployment, not a rare configuration.\\nPR:N - Sending packets through a forwarding router requires no credentials, authentication, or account on the target; the conntrack entry and flow offload are created purely as a side effect of transit traffic. No privilege check exists anywhere between `netif_receive_skb` and `flow_offload_fill_route`.\\nUI:N - The attacker\u0027s own packets drive the entire path; no administrator or user of the router needs to open a file, mount anything, or take any action for the leak to accumulate.\\nS:U - The leaked `struct rtable` objects and the exhausted slab belong to the same kernel that contains the flawed code, and no VM, IOMMU, or sandbox boundary is crossed.\\nC:N - The defect is a missing reference drop, so nothing is freed early, read out of bounds, or copied out \\u2014 the orphaned dst is simply unreachable and no kernel data reaches userspace or any remote peer.\\nI:N - An over-reference is the safe direction: no object is freed prematurely, overwritten, or type-confused, giving no write primitive and no influence over control flow. The offloaded flow itself continues to function correctly because direct xmit never needed the dst.\\nA:H - The leak is unbounded and its rate is limited only by the unauthenticated attacker\u0027s packet rate \\u2014 two packets per unique tuple permanently orphan up to two 184-byte `ip_dst_cache` objects, and neither conntrack expiry nor `nf_conntrack_max` reclaims them, so sustained transit traffic drives the router to memory exhaustion, OOM kill, and loss of forwarding. On IPv6 the inflated `dst_entries` count additionally keeps `fib6_run_gc()` permanently engaged and collapses `ip6_rt_gc_expire`, prematurely expiring legitimate routes.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7c71b831220edeab7ce603d818dc1708d9ea4137\", \"lessThan\": \"13b57b5cd591d5b22f9bbf047b2922967de411f3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9c5662e95a8dcc232c3ef4deb21033badcd260f6\", \"lessThan\": \"a6cafdb49a7bbf4a88367db209703eee6941e023\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fa502c86566680ac62bc28ec883a069bf7a2aa5e\", \"lessThan\": \"9256ab9232e35a16af9c30fa4e522e6d1bd3605a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fa502c86566680ac62bc28ec883a069bf7a2aa5e\", \"lessThan\": \"2d17cf10179a7de6d8f0128168b84ad0b4a1863f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fa502c86566680ac62bc28ec883a069bf7a2aa5e\", \"lessThan\": \"8762785f459be1cfe6fcf7285c123aad6a3703f0\", \"versionType\": \"git\"}], \"programFiles\": [\"net/netfilter/nf_flow_table_core.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.19\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/netfilter/nf_flow_table_core.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/13b57b5cd591d5b22f9bbf047b2922967de411f3\"}, {\"url\": \"https://git.kernel.org/stable/c/a6cafdb49a7bbf4a88367db209703eee6941e023\"}, {\"url\": \"https://git.kernel.org/stable/c/9256ab9232e35a16af9c30fa4e522e6d1bd3605a\"}, {\"url\": \"https://git.kernel.org/stable/c/2d17cf10179a7de6d8f0128168b84ad0b4a1863f\"}, {\"url\": \"https://git.kernel.org/stable/c/8762785f459be1cfe6fcf7285c123aad6a3703f0\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nft_flow_offload: release dst in case direct xmit path is used\\n\\nDirect xmit does not use it since it calls dev_queue_xmit() to send\\npackets, hence it calls dst_release().\\n\\nkmemleak reports:\\n\\nunreferenced object 0xffff88814f440900 (size 184):\\n  comm \\\"softirq\\\", pid 0, jiffies 4294951896\\n  hex dump (first 32 bytes):\\n    00 60 5b 04 81 88 ff ff 00 e6 e8 82 ff ff ff ff  .`[.............\\n    21 0b 50 82 ff ff ff ff 00 00 00 00 00 00 00 00  !.P.............\\n  backtrace (crc cb2bf5d6):\\n    [\u003c000000003ee17107\u003e] kmem_cache_alloc+0x286/0x340\\n    [\u003c0000000021a5de2c\u003e] dst_alloc+0x43/0xb0\\n    [\u003c00000000f0671159\u003e] rt_dst_alloc+0x2e/0x190\\n    [\u003c00000000fe5092c9\u003e] __mkroute_output+0x244/0x980\\n    [\u003c000000005fb96fb0\u003e] ip_route_output_flow+0xc0/0x160\\n    [\u003c0000000045367433\u003e] nf_ip_route+0xf/0x30\\n    [\u003c0000000085da1d8e\u003e] nf_route+0x2d/0x60\\n    [\u003c00000000d1ecd1cb\u003e] nft_flow_route+0x171/0x6a0 [nft_flow_offload]\\n    [\u003c00000000d9b2fb60\u003e] nft_flow_offload_eval+0x4e8/0x700 [nft_flow_offload]\\n    [\u003c000000009f447dbb\u003e] expr_call_ops_eval+0x53/0x330 [nf_tables]\\n    [\u003c00000000072e1be6\u003e] nft_do_chain+0x17c/0x840 [nf_tables]\\n    [\u003c00000000d0551029\u003e] nft_do_chain_inet+0xa1/0x210 [nf_tables]\\n    [\u003c0000000097c9d5c6\u003e] nf_hook_slow+0x5b/0x160\\n    [\u003c0000000005eccab1\u003e] ip_forward+0x8b6/0x9b0\\n    [\u003c00000000553a269b\u003e] ip_rcv+0x221/0x230\\n    [\u003c00000000412872e5\u003e] __netif_receive_skb_one_core+0xfe/0x110\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.19\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.7\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"6.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:27:43.870Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26834\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:27:43.870Z\", \"dateReserved\": \"2024-02-19T14:20:24.181Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-17T10:10:02.282Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.