CVE-2024-26857 (GCVE-0-2024-26857)

Vulnerability from cvelistv5 – Published: 2024-04-17 10:17 – Updated: 2026-08-05 11:27
VLAI
Title
geneve: make sure to pull inner header in geneve_rx()
Summary
In the Linux kernel, the following vulnerability has been resolved: geneve: make sure to pull inner header in geneve_rx() syzbot triggered a bug in geneve_rx() [1] Issue is similar to the one I fixed in commit 8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()") We have to save skb->network_header in a temporary variable in order to be able to recompute the network_header pointer after a pskb_inet_may_pull() call. pskb_inet_may_pull() makes sure the needed headers are in skb->head. [1] BUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline] BUG: KMSAN: uninit-value in geneve_rx drivers/net/geneve.c:279 [inline] BUG: KMSAN: uninit-value in geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391 IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline] geneve_rx drivers/net/geneve.c:279 [inline] geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391 udp_queue_rcv_one_skb+0x1d39/0x1f20 net/ipv4/udp.c:2108 udp_queue_rcv_skb+0x6ae/0x6e0 net/ipv4/udp.c:2186 udp_unicast_rcv_skb+0x184/0x4b0 net/ipv4/udp.c:2346 __udp4_lib_rcv+0x1c6b/0x3010 net/ipv4/udp.c:2422 udp_rcv+0x7d/0xa0 net/ipv4/udp.c:2604 ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [inline] ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:461 [inline] ip_rcv_finish net/ipv4/ip_input.c:449 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core net/core/dev.c:5534 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648 process_backlog+0x480/0x8b0 net/core/dev.c:5976 __napi_poll+0xe3/0x980 net/core/dev.c:6576 napi_poll net/core/dev.c:6645 [inline] net_rx_action+0x8b8/0x1870 net/core/dev.c:6778 __do_softirq+0x1b7/0x7c5 kernel/softirq.c:553 do_softirq+0x9a/0xf0 kernel/softirq.c:454 __local_bh_enable_ip+0x9b/0xa0 kernel/softirq.c:381 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:820 [inline] __dev_queue_xmit+0x2768/0x51c0 net/core/dev.c:4378 dev_queue_xmit include/linux/netdevice.h:3171 [inline] packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3081 [inline] packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: slab_post_alloc_hook mm/slub.c:3819 [inline] slab_alloc_node mm/slub.c:3860 [inline] kmem_cache_alloc_node+0x5cb/0xbc0 mm/slub.c:3903 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560 __alloc_skb+0x352/0x790 net/core/skbuff.c:651 alloc_skb include/linux/skbuff.h:1296 [inline] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6394 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2783 packet_alloc_skb net/packet/af_packet.c:2930 [inline] packet_snd net/packet/af_packet.c:3024 [inline] packet_sendmsg+0x70c2/0x9f10 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Severity
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b , < e431c3227864b5646601c97f5f898d99472f2914 (git)
Affected: 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b , < 59d2a4076983303f324557a114cfd5c32e1f6b29 (git)
Affected: 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b , < c7137900691f5692fe3de54566ea7b30bb35d66c (git)
Affected: 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b , < e77e0b0f2a11735c64b105edaee54d6344faca8a (git)
Affected: 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b , < c0b22568a9d8384fd000cc49acb8f74bde40d1b5 (git)
Affected: 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b , < 0ece581d2a66e8e488c0d3b3e7b5760dbbfdbdd5 (git)
Affected: 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b , < 048e16dee1fc609c1c85072ccd70bfd4b5fef6ca (git)
Affected: 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b , < 1ca1ba465e55b9460e4e75dec9fff31e708fec74 (git)
Create a notification for this product.
Linux Linux Affected: 4.2
Unaffected: 0 , < 4.2 (semver)
Unaffected: 4.19.310 , ≤ 4.19.* (semver)
Unaffected: 5.4.272 , ≤ 5.4.* (semver)
Unaffected: 5.10.213 , ≤ 5.10.* (semver)
Unaffected: 5.15.152 , ≤ 5.15.* (semver)
Unaffected: 6.1.82 , ≤ 6.1.* (semver)
Unaffected: 6.6.22 , ≤ 6.6.* (semver)
Unaffected: 6.7.10 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-26857",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-12T17:32:22.775976Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T16:53:14.290Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.648Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e431c3227864b5646601c97f5f898d99472f2914"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/59d2a4076983303f324557a114cfd5c32e1f6b29"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c7137900691f5692fe3de54566ea7b30bb35d66c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e77e0b0f2a11735c64b105edaee54d6344faca8a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c0b22568a9d8384fd000cc49acb8f74bde40d1b5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0ece581d2a66e8e488c0d3b3e7b5760dbbfdbdd5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/048e16dee1fc609c1c85072ccd70bfd4b5fef6ca"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1ca1ba465e55b9460e4e75dec9fff31e708fec74"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/geneve.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e431c3227864b5646601c97f5f898d99472f2914",
              "status": "affected",
              "version": "2d07dc79fe04a43d82a346ced6bbf07bdb523f1b",
              "versionType": "git"
            },
            {
              "lessThan": "59d2a4076983303f324557a114cfd5c32e1f6b29",
              "status": "affected",
              "version": "2d07dc79fe04a43d82a346ced6bbf07bdb523f1b",
              "versionType": "git"
            },
            {
              "lessThan": "c7137900691f5692fe3de54566ea7b30bb35d66c",
              "status": "affected",
              "version": "2d07dc79fe04a43d82a346ced6bbf07bdb523f1b",
              "versionType": "git"
            },
            {
              "lessThan": "e77e0b0f2a11735c64b105edaee54d6344faca8a",
              "status": "affected",
              "version": "2d07dc79fe04a43d82a346ced6bbf07bdb523f1b",
              "versionType": "git"
            },
            {
              "lessThan": "c0b22568a9d8384fd000cc49acb8f74bde40d1b5",
              "status": "affected",
              "version": "2d07dc79fe04a43d82a346ced6bbf07bdb523f1b",
              "versionType": "git"
            },
            {
              "lessThan": "0ece581d2a66e8e488c0d3b3e7b5760dbbfdbdd5",
              "status": "affected",
              "version": "2d07dc79fe04a43d82a346ced6bbf07bdb523f1b",
              "versionType": "git"
            },
            {
              "lessThan": "048e16dee1fc609c1c85072ccd70bfd4b5fef6ca",
              "status": "affected",
              "version": "2d07dc79fe04a43d82a346ced6bbf07bdb523f1b",
              "versionType": "git"
            },
            {
              "lessThan": "1ca1ba465e55b9460e4e75dec9fff31e708fec74",
              "status": "affected",
              "version": "2d07dc79fe04a43d82a346ced6bbf07bdb523f1b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/geneve.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.310",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.272",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.213",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.310",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.272",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.213",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.152",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.82",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.22",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.10",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngeneve: make sure to pull inner header in geneve_rx()\n\nsyzbot triggered a bug in geneve_rx() [1]\n\nIssue is similar to the one I fixed in commit 8d975c15c0cd\n(\"ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()\")\n\nWe have to save skb-\u003enetwork_header in a temporary variable\nin order to be able to recompute the network_header pointer\nafter a pskb_inet_may_pull() call.\n\npskb_inet_may_pull() makes sure the needed headers are in skb-\u003ehead.\n\n[1]\nBUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]\n BUG: KMSAN: uninit-value in geneve_rx drivers/net/geneve.c:279 [inline]\n BUG: KMSAN: uninit-value in geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391\n  IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]\n  geneve_rx drivers/net/geneve.c:279 [inline]\n  geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391\n  udp_queue_rcv_one_skb+0x1d39/0x1f20 net/ipv4/udp.c:2108\n  udp_queue_rcv_skb+0x6ae/0x6e0 net/ipv4/udp.c:2186\n  udp_unicast_rcv_skb+0x184/0x4b0 net/ipv4/udp.c:2346\n  __udp4_lib_rcv+0x1c6b/0x3010 net/ipv4/udp.c:2422\n  udp_rcv+0x7d/0xa0 net/ipv4/udp.c:2604\n  ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205\n  ip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254\n  dst_input include/net/dst.h:461 [inline]\n  ip_rcv_finish net/ipv4/ip_input.c:449 [inline]\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569\n  __netif_receive_skb_one_core net/core/dev.c:5534 [inline]\n  __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648\n  process_backlog+0x480/0x8b0 net/core/dev.c:5976\n  __napi_poll+0xe3/0x980 net/core/dev.c:6576\n  napi_poll net/core/dev.c:6645 [inline]\n  net_rx_action+0x8b8/0x1870 net/core/dev.c:6778\n  __do_softirq+0x1b7/0x7c5 kernel/softirq.c:553\n  do_softirq+0x9a/0xf0 kernel/softirq.c:454\n  __local_bh_enable_ip+0x9b/0xa0 kernel/softirq.c:381\n  local_bh_enable include/linux/bottom_half.h:33 [inline]\n  rcu_read_unlock_bh include/linux/rcupdate.h:820 [inline]\n  __dev_queue_xmit+0x2768/0x51c0 net/core/dev.c:4378\n  dev_queue_xmit include/linux/netdevice.h:3171 [inline]\n  packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276\n  packet_snd net/packet/af_packet.c:3081 [inline]\n  packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg net/socket.c:745 [inline]\n  __sys_sendto+0x735/0xa10 net/socket.c:2191\n  __do_sys_sendto net/socket.c:2203 [inline]\n  __se_sys_sendto net/socket.c:2199 [inline]\n  __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:3819 [inline]\n  slab_alloc_node mm/slub.c:3860 [inline]\n  kmem_cache_alloc_node+0x5cb/0xbc0 mm/slub.c:3903\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560\n  __alloc_skb+0x352/0x790 net/core/skbuff.c:651\n  alloc_skb include/linux/skbuff.h:1296 [inline]\n  alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6394\n  sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2783\n  packet_alloc_skb net/packet/af_packet.c:2930 [inline]\n  packet_snd net/packet/af_packet.c:3024 [inline]\n  packet_sendmsg+0x70c2/0x9f10 net/packet/af_packet.c:3113\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg net/socket.c:745 [inline]\n  __sys_sendto+0x735/0xa10 net/socket.c:2191\n  __do_sys_sendto net/socket.c:2203 [inline]\n  __se_sys_sendto net/socket.c:2199 [inline]\n  __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is the GENEVE UDP encapsulation receive handler for a socket bound to INADDR_ANY on UDP port 6081, reached directly from `udp_rcv()` on a received packet. In collect_md/external mode (standard OVS/OVN cloud overlay) `geneve_lookup_skb()` accepts any remote source address, so any host that can send UDP to the tunnel endpoint reaches `geneve_rx()`.\nAC:L - The attacker fully controls the skb layout: sending the encapsulated packet as IP fragments makes `ip_defrag()` produce a frag_list skb whose linear area ends exactly at the inner Ethernet header, deterministically placing `skb-\u003edata` at `skb-\u003etail` before the ECN read. Outer IP options and geneve option length give additional 4-byte tuning for NIC-driven fragment layouts.\nPR:N - There is no authentication, capability check, or credential validation anywhere on the `ip_rcv` \u2192 `udp_rcv` \u2192 `geneve_udp_encap_recv` \u2192 `geneve_rx` path. An unauthenticated remote peer only needs to send a crafted UDP datagram to the tunnel port.\nUI:N - The bug triggers entirely during softirq packet receive processing on the target host; no local user has to open, mount, or interact with anything.\nS:U - The uninitialized read occurs in kernel network receive context and its effects (ECN decision, packet drop) stay within the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:L - The bug reads uninitialized kernel heap memory past the end of the valid skb data, but is strictly bounded to 1 byte (IPv4 TOS) or 2 bytes (IPv6 dsfield) and stays inside the `skb-\u003ehead` allocation. The stale contents are not returned to the attacker directly \u2014 they leak only as a per-packet drop/no-drop oracle from `__INET_ECN_decapsulate()`.\nI:L - The uninitialized byte drives whether the decapsulated packet is dropped and whether CE/ECT(1) marking is applied to tunneled traffic, so data traversing the tunnel can be modified or discarded based on garbage. The amount is minimal and the attacker has no control over the consequence; `INET_ECN_set_ce()`/`set_ect1()` are bounds-checked, so no out-of-bounds write primitive exists.\nA:L - Incorrect ECN decapsulation driven by uninitialized memory causes spurious drops of legitimate GENEVE-tunneled traffic (`err \u003e 1` \u2192 `kfree_skb`), degrading overlay connectivity. There is no kernel crash on production configurations \u2014 the read stays within the `skb-\u003ehead` slab object so KASAN does not fire, and only the KMSAN debug tool reports it."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:27:51.379Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e431c3227864b5646601c97f5f898d99472f2914"
        },
        {
          "url": "https://git.kernel.org/stable/c/59d2a4076983303f324557a114cfd5c32e1f6b29"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7137900691f5692fe3de54566ea7b30bb35d66c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e77e0b0f2a11735c64b105edaee54d6344faca8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0b22568a9d8384fd000cc49acb8f74bde40d1b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ece581d2a66e8e488c0d3b3e7b5760dbbfdbdd5"
        },
        {
          "url": "https://git.kernel.org/stable/c/048e16dee1fc609c1c85072ccd70bfd4b5fef6ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ca1ba465e55b9460e4e75dec9fff31e708fec74"
        }
      ],
      "title": "geneve: make sure to pull inner header in geneve_rx()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26857",
    "datePublished": "2024-04-17T10:17:19.115Z",
    "dateReserved": "2024-02-19T14:20:24.183Z",
    "dateUpdated": "2026-08-05T11:27:51.379Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26857",
      "date": "2026-08-05",
      "epss": "0.00601",
      "percentile": "0.45382"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngeneve: make sure to pull inner header in geneve_rx()\\n\\nsyzbot triggered a bug in geneve_rx() [1]\\n\\nIssue is similar to the one I fixed in commit 8d975c15c0cd\\n(\\\"ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()\\\")\\n\\nWe have to save skb-\u003enetwork_header in a temporary variable\\nin order to be able to recompute the network_header pointer\\nafter a pskb_inet_may_pull() call.\\n\\npskb_inet_may_pull() makes sure the needed headers are in skb-\u003ehead.\\n\\n[1]\\nBUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]\\n BUG: KMSAN: uninit-value in geneve_rx drivers/net/geneve.c:279 [inline]\\n BUG: KMSAN: uninit-value in geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391\\n  IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]\\n  geneve_rx drivers/net/geneve.c:279 [inline]\\n  geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391\\n  udp_queue_rcv_one_skb+0x1d39/0x1f20 net/ipv4/udp.c:2108\\n  udp_queue_rcv_skb+0x6ae/0x6e0 net/ipv4/udp.c:2186\\n  udp_unicast_rcv_skb+0x184/0x4b0 net/ipv4/udp.c:2346\\n  __udp4_lib_rcv+0x1c6b/0x3010 net/ipv4/udp.c:2422\\n  udp_rcv+0x7d/0xa0 net/ipv4/udp.c:2604\\n  ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205\\n  ip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233\\n  NF_HOOK include/linux/netfilter.h:314 [inline]\\n  ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254\\n  dst_input include/net/dst.h:461 [inline]\\n  ip_rcv_finish net/ipv4/ip_input.c:449 [inline]\\n  NF_HOOK include/linux/netfilter.h:314 [inline]\\n  ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569\\n  __netif_receive_skb_one_core net/core/dev.c:5534 [inline]\\n  __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648\\n  process_backlog+0x480/0x8b0 net/core/dev.c:5976\\n  __napi_poll+0xe3/0x980 net/core/dev.c:6576\\n  napi_poll net/core/dev.c:6645 [inline]\\n  net_rx_action+0x8b8/0x1870 net/core/dev.c:6778\\n  __do_softirq+0x1b7/0x7c5 kernel/softirq.c:553\\n  do_softirq+0x9a/0xf0 kernel/softirq.c:454\\n  __local_bh_enable_ip+0x9b/0xa0 kernel/softirq.c:381\\n  local_bh_enable include/linux/bottom_half.h:33 [inline]\\n  rcu_read_unlock_bh include/linux/rcupdate.h:820 [inline]\\n  __dev_queue_xmit+0x2768/0x51c0 net/core/dev.c:4378\\n  dev_queue_xmit include/linux/netdevice.h:3171 [inline]\\n  packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276\\n  packet_snd net/packet/af_packet.c:3081 [inline]\\n  packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113\\n  sock_sendmsg_nosec net/socket.c:730 [inline]\\n  __sock_sendmsg net/socket.c:745 [inline]\\n  __sys_sendto+0x735/0xa10 net/socket.c:2191\\n  __do_sys_sendto net/socket.c:2203 [inline]\\n  __se_sys_sendto net/socket.c:2199 [inline]\\n  __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n  do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\\n\\nUninit was created at:\\n  slab_post_alloc_hook mm/slub.c:3819 [inline]\\n  slab_alloc_node mm/slub.c:3860 [inline]\\n  kmem_cache_alloc_node+0x5cb/0xbc0 mm/slub.c:3903\\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560\\n  __alloc_skb+0x352/0x790 net/core/skbuff.c:651\\n  alloc_skb include/linux/skbuff.h:1296 [inline]\\n  alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6394\\n  sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2783\\n  packet_alloc_skb net/packet/af_packet.c:2930 [inline]\\n  packet_snd net/packet/af_packet.c:3024 [inline]\\n  packet_sendmsg+0x70c2/0x9f10 net/packet/af_packet.c:3113\\n  sock_sendmsg_nosec net/socket.c:730 [inline]\\n  __sock_sendmsg net/socket.c:745 [inline]\\n  __sys_sendto+0x735/0xa10 net/socket.c:2191\\n  __do_sys_sendto net/socket.c:2203 [inline]\\n  __se_sys_sendto net/socket.c:2199 [inline]\\n  __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n  do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: geneve: aseg\\u00farese de extraer el encabezado interno en geneve_rx() syzbot desencaden\\u00f3 un error en geneve_rx() [1] El problema es similar al que solucion\\u00e9 en la confirmaci\\u00f3n 8d975c15c0cd (\\\"ip6_tunnel: aseg\\u00farese de extraer el encabezado interno en __ip6_tnl_rcv()\\\"). Tenemos que guardar skb-\u0026gt;network_header en una variable temporal para poder volver a calcular el puntero network_header despu\\u00e9s de una llamada a pskb_inet_may_pull(). pskb_inet_may_pull() se asegura de que los encabezados necesarios est\\u00e9n en skb-\u0026gt;head. [1] ERROR: KMSAN: valor uninit en IP_ECN_decapsulate include/net/inet_ecn.h:302 [en l\\u00ednea] ERROR: KMSAN: valor uninit en geneve_rx drivers/net/geneve.c:279 [en l\\u00ednea] ERROR: KMSAN: uninit -valor en geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391 IP_ECN_decapsulate include/net/inet_ecn.h:302 [en l\\u00ednea] geneve_rx drivers/net/geneve.c:279 [en l\\u00ednea] geneve_udp_encap_recv+0x36f9/0x3c10 drivers/ net/geneve.c:391 udp_queue_rcv_one_skb+0x1d39/0x1f20 net/ipv4/udp.c:2108 udp_queue_rcv_skb+0x6ae/0x6e0 net/ipv4/udp.c:2186 udp_unicast_rcv_skb+0x184/0x4b0 net/ipv4/udp. c:2346 __udp4_lib_rcv +0x1c6b/0x3010 net/ipv4/udp.c:2422 udp_rcv+0x7d/0xa0 net/ipv4/udp.c:2604 ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2b8/0x440 net/ ipv4/ ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [en l\\u00ednea] ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:461 [en l\\u00ednea] ip_rcv_finish net/ipv4/ ip_input.c:449 [en l\\u00ednea] NF_HOOK include/linux/netfilter.h:314 [en l\\u00ednea] ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core net/core/dev.c:5534 [en l\\u00ednea] __netif_receive_skb+ 0x1a6/0x5a0 net/core/dev.c:5648 Process_backlog+0x480/0x8b0 net/core/dev.c:5976 __napi_poll+0xe3/0x980 net/core/dev.c:6576 napi_poll net/core/dev.c:6645 [en l\\u00ednea] net_rx_action+0x8b8/0x1870 net/core/dev.c:6778 __do_softirq+0x1b7/0x7c5 kernel/softirq.c:553 do_softirq+0x9a/0xf0 kernel/softirq.c:454 __local_bh_enable_ip+0x9b/0xa0 kernel/softirq. c:381 local_bh_enable include/linux/bottom_half.h:33 [en l\\u00ednea] rcu_read_unlock_bh include/linux/rcupdate.h:820 [en l\\u00ednea] __dev_queue_xmit+0x2768/0x51c0 net/core/dev.c:4378 dev_queue_xmit include/linux/netdevice. h:3171 [en l\\u00ednea] paquete_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 paquete_snd net/packet/af_packet.c:3081 [en l\\u00ednea] paquete_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/ socket.c:730 [en l\\u00ednea] __sock_sendmsg net/socket.c:745 [en l\\u00ednea] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [en l\\u00ednea] __se_sys_sendto net/socket.c:2199 [en l\\u00ednea] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [en l\\u00ednea] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 Entry_SYSCALL_64_after_hwframe+0x63 / 0x6b Uninit se cre\\u00f3 en: slab_post_alloc_hook mm/slub.c:3819 [en l\\u00ednea] slab_alloc_node mm/slub.c:3860 [en l\\u00ednea] kmem_cache_alloc_node+0x5cb/0xbc0 mm/slub.c:3903 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff .c:560 __alloc_skb+0x352/0x790 net/core/skbuff.c:651 alloc_skb include/linux/skbuff.h:1296 [en l\\u00ednea] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6394 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2783 paquete_alloc_skb net/packet/af_packet.c:2930 [en l\\u00ednea] paquete_snd net/packet/af_packet.c:3024 [en l\\u00ednea] paquete_sendmsg+0x70c2/0x9f10 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [en l\\u00ednea] __sock_sendmsg net/socket.c:745 [en l\\u00ednea] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [en l\\u00ednea] __se_sys_sendto net/socket.c :2199 [en l\\u00ednea] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [en l\\u00ednea] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 Entry_SYSCALL_64_after_hwframe + 0x63/0x6b\"}]",
      "id": "CVE-2024-26857",
      "lastModified": "2024-11-21T09:03:13.687",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-04-17T11:15:08.787",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/048e16dee1fc609c1c85072ccd70bfd4b5fef6ca\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/0ece581d2a66e8e488c0d3b3e7b5760dbbfdbdd5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/1ca1ba465e55b9460e4e75dec9fff31e708fec74\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/59d2a4076983303f324557a114cfd5c32e1f6b29\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c0b22568a9d8384fd000cc49acb8f74bde40d1b5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c7137900691f5692fe3de54566ea7b30bb35d66c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/e431c3227864b5646601c97f5f898d99472f2914\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/e77e0b0f2a11735c64b105edaee54d6344faca8a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/048e16dee1fc609c1c85072ccd70bfd4b5fef6ca\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/0ece581d2a66e8e488c0d3b3e7b5760dbbfdbdd5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/1ca1ba465e55b9460e4e75dec9fff31e708fec74\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/59d2a4076983303f324557a114cfd5c32e1f6b29\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/c0b22568a9d8384fd000cc49acb8f74bde40d1b5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/c7137900691f5692fe3de54566ea7b30bb35d66c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/e431c3227864b5646601c97f5f898d99472f2914\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/e77e0b0f2a11735c64b105edaee54d6344faca8a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26857\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-17T11:15:08.787\",\"lastModified\":\"2026-08-04T11:17:14.063\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngeneve: make sure to pull inner header in geneve_rx()\\n\\nsyzbot triggered a bug in geneve_rx() [1]\\n\\nIssue is similar to the one I fixed in commit 8d975c15c0cd\\n(\\\"ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()\\\")\\n\\nWe have to save skb-\u003enetwork_header in a temporary variable\\nin order to be able to recompute the network_header pointer\\nafter a pskb_inet_may_pull() call.\\n\\npskb_inet_may_pull() makes sure the needed headers are in skb-\u003ehead.\\n\\n[1]\\nBUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]\\n BUG: KMSAN: uninit-value in geneve_rx drivers/net/geneve.c:279 [inline]\\n BUG: KMSAN: uninit-value in geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391\\n  IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]\\n  geneve_rx drivers/net/geneve.c:279 [inline]\\n  geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391\\n  udp_queue_rcv_one_skb+0x1d39/0x1f20 net/ipv4/udp.c:2108\\n  udp_queue_rcv_skb+0x6ae/0x6e0 net/ipv4/udp.c:2186\\n  udp_unicast_rcv_skb+0x184/0x4b0 net/ipv4/udp.c:2346\\n  __udp4_lib_rcv+0x1c6b/0x3010 net/ipv4/udp.c:2422\\n  udp_rcv+0x7d/0xa0 net/ipv4/udp.c:2604\\n  ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205\\n  ip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233\\n  NF_HOOK include/linux/netfilter.h:314 [inline]\\n  ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254\\n  dst_input include/net/dst.h:461 [inline]\\n  ip_rcv_finish net/ipv4/ip_input.c:449 [inline]\\n  NF_HOOK include/linux/netfilter.h:314 [inline]\\n  ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569\\n  __netif_receive_skb_one_core net/core/dev.c:5534 [inline]\\n  __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648\\n  process_backlog+0x480/0x8b0 net/core/dev.c:5976\\n  __napi_poll+0xe3/0x980 net/core/dev.c:6576\\n  napi_poll net/core/dev.c:6645 [inline]\\n  net_rx_action+0x8b8/0x1870 net/core/dev.c:6778\\n  __do_softirq+0x1b7/0x7c5 kernel/softirq.c:553\\n  do_softirq+0x9a/0xf0 kernel/softirq.c:454\\n  __local_bh_enable_ip+0x9b/0xa0 kernel/softirq.c:381\\n  local_bh_enable include/linux/bottom_half.h:33 [inline]\\n  rcu_read_unlock_bh include/linux/rcupdate.h:820 [inline]\\n  __dev_queue_xmit+0x2768/0x51c0 net/core/dev.c:4378\\n  dev_queue_xmit include/linux/netdevice.h:3171 [inline]\\n  packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276\\n  packet_snd net/packet/af_packet.c:3081 [inline]\\n  packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113\\n  sock_sendmsg_nosec net/socket.c:730 [inline]\\n  __sock_sendmsg net/socket.c:745 [inline]\\n  __sys_sendto+0x735/0xa10 net/socket.c:2191\\n  __do_sys_sendto net/socket.c:2203 [inline]\\n  __se_sys_sendto net/socket.c:2199 [inline]\\n  __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n  do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\\n\\nUninit was created at:\\n  slab_post_alloc_hook mm/slub.c:3819 [inline]\\n  slab_alloc_node mm/slub.c:3860 [inline]\\n  kmem_cache_alloc_node+0x5cb/0xbc0 mm/slub.c:3903\\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560\\n  __alloc_skb+0x352/0x790 net/core/skbuff.c:651\\n  alloc_skb include/linux/skbuff.h:1296 [inline]\\n  alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6394\\n  sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2783\\n  packet_alloc_skb net/packet/af_packet.c:2930 [inline]\\n  packet_snd net/packet/af_packet.c:3024 [inline]\\n  packet_sendmsg+0x70c2/0x9f10 net/packet/af_packet.c:3113\\n  sock_sendmsg_nosec net/socket.c:730 [inline]\\n  __sock_sendmsg net/socket.c:745 [inline]\\n  __sys_sendto+0x735/0xa10 net/socket.c:2191\\n  __do_sys_sendto net/socket.c:2203 [inline]\\n  __se_sys_sendto net/socket.c:2199 [inline]\\n  __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n  do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: geneve: aseg\u00farese de extraer el encabezado interno en geneve_rx() syzbot desencaden\u00f3 un error en geneve_rx() [1] El problema es similar al que solucion\u00e9 en la confirmaci\u00f3n 8d975c15c0cd (\\\"ip6_tunnel: aseg\u00farese de extraer el encabezado interno en __ip6_tnl_rcv()\\\"). Tenemos que guardar skb-\u0026gt;network_header en una variable temporal para poder volver a calcular el puntero network_header despu\u00e9s de una llamada a pskb_inet_may_pull(). pskb_inet_may_pull() se asegura de que los encabezados necesarios est\u00e9n en skb-\u0026gt;head. [1] ERROR: KMSAN: valor uninit en IP_ECN_decapsulate include/net/inet_ecn.h:302 [en l\u00ednea] ERROR: KMSAN: valor uninit en geneve_rx drivers/net/geneve.c:279 [en l\u00ednea] ERROR: KMSAN: uninit -valor en geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391 IP_ECN_decapsulate include/net/inet_ecn.h:302 [en l\u00ednea] geneve_rx drivers/net/geneve.c:279 [en l\u00ednea] geneve_udp_encap_recv+0x36f9/0x3c10 drivers/ net/geneve.c:391 udp_queue_rcv_one_skb+0x1d39/0x1f20 net/ipv4/udp.c:2108 udp_queue_rcv_skb+0x6ae/0x6e0 net/ipv4/udp.c:2186 udp_unicast_rcv_skb+0x184/0x4b0 net/ipv4/udp. c:2346 __udp4_lib_rcv +0x1c6b/0x3010 net/ipv4/udp.c:2422 udp_rcv+0x7d/0xa0 net/ipv4/udp.c:2604 ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2b8/0x440 net/ ipv4/ ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [en l\u00ednea] ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:461 [en l\u00ednea] ip_rcv_finish net/ipv4/ ip_input.c:449 [en l\u00ednea] NF_HOOK include/linux/netfilter.h:314 [en l\u00ednea] ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core net/core/dev.c:5534 [en l\u00ednea] __netif_receive_skb+ 0x1a6/0x5a0 net/core/dev.c:5648 Process_backlog+0x480/0x8b0 net/core/dev.c:5976 __napi_poll+0xe3/0x980 net/core/dev.c:6576 napi_poll net/core/dev.c:6645 [en l\u00ednea] net_rx_action+0x8b8/0x1870 net/core/dev.c:6778 __do_softirq+0x1b7/0x7c5 kernel/softirq.c:553 do_softirq+0x9a/0xf0 kernel/softirq.c:454 __local_bh_enable_ip+0x9b/0xa0 kernel/softirq. c:381 local_bh_enable include/linux/bottom_half.h:33 [en l\u00ednea] rcu_read_unlock_bh include/linux/rcupdate.h:820 [en l\u00ednea] __dev_queue_xmit+0x2768/0x51c0 net/core/dev.c:4378 dev_queue_xmit include/linux/netdevice. h:3171 [en l\u00ednea] paquete_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 paquete_snd net/packet/af_packet.c:3081 [en l\u00ednea] paquete_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/ socket.c:730 [en l\u00ednea] __sock_sendmsg net/socket.c:745 [en l\u00ednea] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [en l\u00ednea] __se_sys_sendto net/socket.c:2199 [en l\u00ednea] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [en l\u00ednea] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 Entry_SYSCALL_64_after_hwframe+0x63 / 0x6b Uninit se cre\u00f3 en: slab_post_alloc_hook mm/slub.c:3819 [en l\u00ednea] slab_alloc_node mm/slub.c:3860 [en l\u00ednea] kmem_cache_alloc_node+0x5cb/0xbc0 mm/slub.c:3903 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff .c:560 __alloc_skb+0x352/0x790 net/core/skbuff.c:651 alloc_skb include/linux/skbuff.h:1296 [en l\u00ednea] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6394 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2783 paquete_alloc_skb net/packet/af_packet.c:2930 [en l\u00ednea] paquete_snd net/packet/af_packet.c:3024 [en l\u00ednea] paquete_sendmsg+0x70c2/0x9f10 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [en l\u00ednea] __sock_sendmsg net/socket.c:745 [en l\u00ednea] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [en l\u00ednea] __se_sys_sendto net/socket.c :2199 [en l\u00ednea] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [en l\u00ednea] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 Entry_SYSCALL_64_after_hwframe + 0x63/0x6b\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/geneve.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2d07dc79fe04a43d82a346ced6bbf07bdb523f1b\",\"lessThan\":\"e431c3227864b5646601c97f5f898d99472f2914\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2d07dc79fe04a43d82a346ced6bbf07bdb523f1b\",\"lessThan\":\"59d2a4076983303f324557a114cfd5c32e1f6b29\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2d07dc79fe04a43d82a346ced6bbf07bdb523f1b\",\"lessThan\":\"c7137900691f5692fe3de54566ea7b30bb35d66c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2d07dc79fe04a43d82a346ced6bbf07bdb523f1b\",\"lessThan\":\"e77e0b0f2a11735c64b105edaee54d6344faca8a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2d07dc79fe04a43d82a346ced6bbf07bdb523f1b\",\"lessThan\":\"c0b22568a9d8384fd000cc49acb8f74bde40d1b5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2d07dc79fe04a43d82a346ced6bbf07bdb523f1b\",\"lessThan\":\"0ece581d2a66e8e488c0d3b3e7b5760dbbfdbdd5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2d07dc79fe04a43d82a346ced6bbf07bdb523f1b\",\"lessThan\":\"048e16dee1fc609c1c85072ccd70bfd4b5fef6ca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2d07dc79fe04a43d82a346ced6bbf07bdb523f1b\",\"lessThan\":\"1ca1ba465e55b9460e4e75dec9fff31e708fec74\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/geneve.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.310\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.272\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.213\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.152\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.82\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.22\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.10\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":3.4},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-12T17:32:22.775976Z\",\"id\":\"CVE-2024-26857\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-908\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.2\",\"versionEndExcluding\":\"4.19.310\",\"matchCriteriaId\":\"C50AF57E-9F7B-4466-BFE4-42DB6C57F184\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.272\",\"matchCriteriaId\":\"06199E67-91F5-4EC0-828B-22825E4DBAD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.213\",\"matchCriteriaId\":\"CE7B425A-A38B-494A-AA47-EC2251748164\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.152\",\"matchCriteriaId\":\"DBBE9241-559E-479A-895A-02186BA03EBF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.82\",\"matchCriteriaId\":\"933AC628-7DAD-4B2D-82E3-3B7B331B1C09\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.22\",\"matchCriteriaId\":\"AC6FD6F8-5B16-4F53-8116-D42F4BF4FBAC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.10\",\"matchCriteriaId\":\"FB4549F9-0160-455F-8CDC-98D38AEF6D66\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"A780F817-2A77-4130-A9B7-5C25606314E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"AEB9199B-AB8F-4877-8964-E2BA95B5F15C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/048e16dee1fc609c1c85072ccd70bfd4b5fef6ca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0ece581d2a66e8e488c0d3b3e7b5760dbbfdbdd5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1ca1ba465e55b9460e4e75dec9fff31e708fec74\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/59d2a4076983303f324557a114cfd5c32e1f6b29\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c0b22568a9d8384fd000cc49acb8f74bde40d1b5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c7137900691f5692fe3de54566ea7b30bb35d66c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e431c3227864b5646601c97f5f898d99472f2914\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e77e0b0f2a11735c64b105edaee54d6344faca8a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/048e16dee1fc609c1c85072ccd70bfd4b5fef6ca\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0ece581d2a66e8e488c0d3b3e7b5760dbbfdbdd5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1ca1ba465e55b9460e4e75dec9fff31e708fec74\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/59d2a4076983303f324557a114cfd5c32e1f6b29\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c0b22568a9d8384fd000cc49acb8f74bde40d1b5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c7137900691f5692fe3de54566ea7b30bb35d66c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e431c3227864b5646601c97f5f898d99472f2914\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e77e0b0f2a11735c64b105edaee54d6344faca8a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:50:57+00:00",
      "cve": "CVE-2024-26857",
      "id": "CVE-2024-26857",
      "initial_release_date": "2024-04-17T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "98",
      "product_status:known_not_affected": "22",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: geneve: make sure to pull inner header in geneve_rx()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26857.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-26T23:35:39Z",
      "cve": "CVE-2024-26857",
      "id": "CVE-2024-26857",
      "initial_release_date": "2024-04-19T02:18:38Z",
      "product_status:known_affected": "538",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "764",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26857",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26857.json",
      "version": "98"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e431c3227864b5646601c97f5f898d99472f2914\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/59d2a4076983303f324557a114cfd5c32e1f6b29\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c7137900691f5692fe3de54566ea7b30bb35d66c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e77e0b0f2a11735c64b105edaee54d6344faca8a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c0b22568a9d8384fd000cc49acb8f74bde40d1b5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0ece581d2a66e8e488c0d3b3e7b5760dbbfdbdd5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/048e16dee1fc609c1c85072ccd70bfd4b5fef6ca\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1ca1ba465e55b9460e4e75dec9fff31e708fec74\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.648Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26857\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-12T17:32:22.775976Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-12T17:32:54.215Z\"}}], \"cna\": {\"title\": \"geneve: make sure to pull inner header in geneve_rx()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.3, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The vulnerable code is the GENEVE UDP encapsulation receive handler for a socket bound to INADDR_ANY on UDP port 6081, reached directly from `udp_rcv()` on a received packet. In collect_md/external mode (standard OVS/OVN cloud overlay) `geneve_lookup_skb()` accepts any remote source address, so any host that can send UDP to the tunnel endpoint reaches `geneve_rx()`.\\nAC:L - The attacker fully controls the skb layout: sending the encapsulated packet as IP fragments makes `ip_defrag()` produce a frag_list skb whose linear area ends exactly at the inner Ethernet header, deterministically placing `skb-\u003edata` at `skb-\u003etail` before the ECN read. Outer IP options and geneve option length give additional 4-byte tuning for NIC-driven fragment layouts.\\nPR:N - There is no authentication, capability check, or credential validation anywhere on the `ip_rcv` \\u2192 `udp_rcv` \\u2192 `geneve_udp_encap_recv` \\u2192 `geneve_rx` path. An unauthenticated remote peer only needs to send a crafted UDP datagram to the tunnel port.\\nUI:N - The bug triggers entirely during softirq packet receive processing on the target host; no local user has to open, mount, or interact with anything.\\nS:U - The uninitialized read occurs in kernel network receive context and its effects (ECN decision, packet drop) stay within the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\\nC:L - The bug reads uninitialized kernel heap memory past the end of the valid skb data, but is strictly bounded to 1 byte (IPv4 TOS) or 2 bytes (IPv6 dsfield) and stays inside the `skb-\u003ehead` allocation. The stale contents are not returned to the attacker directly \\u2014 they leak only as a per-packet drop/no-drop oracle from `__INET_ECN_decapsulate()`.\\nI:L - The uninitialized byte drives whether the decapsulated packet is dropped and whether CE/ECT(1) marking is applied to tunneled traffic, so data traversing the tunnel can be modified or discarded based on garbage. The amount is minimal and the attacker has no control over the consequence; `INET_ECN_set_ce()`/`set_ect1()` are bounds-checked, so no out-of-bounds write primitive exists.\\nA:L - Incorrect ECN decapsulation driven by uninitialized memory causes spurious drops of legitimate GENEVE-tunneled traffic (`err \u003e 1` \\u2192 `kfree_skb`), degrading overlay connectivity. There is no kernel crash on production configurations \\u2014 the read stays within the `skb-\u003ehead` slab object so KASAN does not fire, and only the KMSAN debug tool reports it.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2d07dc79fe04a43d82a346ced6bbf07bdb523f1b\", \"lessThan\": \"e431c3227864b5646601c97f5f898d99472f2914\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2d07dc79fe04a43d82a346ced6bbf07bdb523f1b\", \"lessThan\": \"59d2a4076983303f324557a114cfd5c32e1f6b29\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2d07dc79fe04a43d82a346ced6bbf07bdb523f1b\", \"lessThan\": \"c7137900691f5692fe3de54566ea7b30bb35d66c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2d07dc79fe04a43d82a346ced6bbf07bdb523f1b\", \"lessThan\": \"e77e0b0f2a11735c64b105edaee54d6344faca8a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2d07dc79fe04a43d82a346ced6bbf07bdb523f1b\", \"lessThan\": \"c0b22568a9d8384fd000cc49acb8f74bde40d1b5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2d07dc79fe04a43d82a346ced6bbf07bdb523f1b\", \"lessThan\": \"0ece581d2a66e8e488c0d3b3e7b5760dbbfdbdd5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2d07dc79fe04a43d82a346ced6bbf07bdb523f1b\", \"lessThan\": \"048e16dee1fc609c1c85072ccd70bfd4b5fef6ca\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2d07dc79fe04a43d82a346ced6bbf07bdb523f1b\", \"lessThan\": \"1ca1ba465e55b9460e4e75dec9fff31e708fec74\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/geneve.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.310\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.272\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.213\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.152\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.82\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.22\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/geneve.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e431c3227864b5646601c97f5f898d99472f2914\"}, {\"url\": \"https://git.kernel.org/stable/c/59d2a4076983303f324557a114cfd5c32e1f6b29\"}, {\"url\": \"https://git.kernel.org/stable/c/c7137900691f5692fe3de54566ea7b30bb35d66c\"}, {\"url\": \"https://git.kernel.org/stable/c/e77e0b0f2a11735c64b105edaee54d6344faca8a\"}, {\"url\": \"https://git.kernel.org/stable/c/c0b22568a9d8384fd000cc49acb8f74bde40d1b5\"}, {\"url\": \"https://git.kernel.org/stable/c/0ece581d2a66e8e488c0d3b3e7b5760dbbfdbdd5\"}, {\"url\": \"https://git.kernel.org/stable/c/048e16dee1fc609c1c85072ccd70bfd4b5fef6ca\"}, {\"url\": \"https://git.kernel.org/stable/c/1ca1ba465e55b9460e4e75dec9fff31e708fec74\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngeneve: make sure to pull inner header in geneve_rx()\\n\\nsyzbot triggered a bug in geneve_rx() [1]\\n\\nIssue is similar to the one I fixed in commit 8d975c15c0cd\\n(\\\"ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()\\\")\\n\\nWe have to save skb-\u003enetwork_header in a temporary variable\\nin order to be able to recompute the network_header pointer\\nafter a pskb_inet_may_pull() call.\\n\\npskb_inet_may_pull() makes sure the needed headers are in skb-\u003ehead.\\n\\n[1]\\nBUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]\\n BUG: KMSAN: uninit-value in geneve_rx drivers/net/geneve.c:279 [inline]\\n BUG: KMSAN: uninit-value in geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391\\n  IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]\\n  geneve_rx drivers/net/geneve.c:279 [inline]\\n  geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391\\n  udp_queue_rcv_one_skb+0x1d39/0x1f20 net/ipv4/udp.c:2108\\n  udp_queue_rcv_skb+0x6ae/0x6e0 net/ipv4/udp.c:2186\\n  udp_unicast_rcv_skb+0x184/0x4b0 net/ipv4/udp.c:2346\\n  __udp4_lib_rcv+0x1c6b/0x3010 net/ipv4/udp.c:2422\\n  udp_rcv+0x7d/0xa0 net/ipv4/udp.c:2604\\n  ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205\\n  ip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233\\n  NF_HOOK include/linux/netfilter.h:314 [inline]\\n  ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254\\n  dst_input include/net/dst.h:461 [inline]\\n  ip_rcv_finish net/ipv4/ip_input.c:449 [inline]\\n  NF_HOOK include/linux/netfilter.h:314 [inline]\\n  ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569\\n  __netif_receive_skb_one_core net/core/dev.c:5534 [inline]\\n  __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648\\n  process_backlog+0x480/0x8b0 net/core/dev.c:5976\\n  __napi_poll+0xe3/0x980 net/core/dev.c:6576\\n  napi_poll net/core/dev.c:6645 [inline]\\n  net_rx_action+0x8b8/0x1870 net/core/dev.c:6778\\n  __do_softirq+0x1b7/0x7c5 kernel/softirq.c:553\\n  do_softirq+0x9a/0xf0 kernel/softirq.c:454\\n  __local_bh_enable_ip+0x9b/0xa0 kernel/softirq.c:381\\n  local_bh_enable include/linux/bottom_half.h:33 [inline]\\n  rcu_read_unlock_bh include/linux/rcupdate.h:820 [inline]\\n  __dev_queue_xmit+0x2768/0x51c0 net/core/dev.c:4378\\n  dev_queue_xmit include/linux/netdevice.h:3171 [inline]\\n  packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276\\n  packet_snd net/packet/af_packet.c:3081 [inline]\\n  packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113\\n  sock_sendmsg_nosec net/socket.c:730 [inline]\\n  __sock_sendmsg net/socket.c:745 [inline]\\n  __sys_sendto+0x735/0xa10 net/socket.c:2191\\n  __do_sys_sendto net/socket.c:2203 [inline]\\n  __se_sys_sendto net/socket.c:2199 [inline]\\n  __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n  do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\\n\\nUninit was created at:\\n  slab_post_alloc_hook mm/slub.c:3819 [inline]\\n  slab_alloc_node mm/slub.c:3860 [inline]\\n  kmem_cache_alloc_node+0x5cb/0xbc0 mm/slub.c:3903\\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560\\n  __alloc_skb+0x352/0x790 net/core/skbuff.c:651\\n  alloc_skb include/linux/skbuff.h:1296 [inline]\\n  alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6394\\n  sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2783\\n  packet_alloc_skb net/packet/af_packet.c:2930 [inline]\\n  packet_snd net/packet/af_packet.c:3024 [inline]\\n  packet_sendmsg+0x70c2/0x9f10 net/packet/af_packet.c:3113\\n  sock_sendmsg_nosec net/socket.c:730 [inline]\\n  __sock_sendmsg net/socket.c:745 [inline]\\n  __sys_sendto+0x735/0xa10 net/socket.c:2191\\n  __do_sys_sendto net/socket.c:2203 [inline]\\n  __se_sys_sendto net/socket.c:2199 [inline]\\n  __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n  do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.310\", \"versionStartIncluding\": \"4.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.272\", \"versionStartIncluding\": \"4.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.213\", \"versionStartIncluding\": \"4.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.152\", \"versionStartIncluding\": \"4.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.82\", \"versionStartIncluding\": \"4.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.22\", \"versionStartIncluding\": \"4.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.10\", \"versionStartIncluding\": \"4.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"4.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:27:51.379Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26857\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:27:51.379Z\", \"dateReserved\": \"2024-02-19T14:20:24.183Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-17T10:17:19.115Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.