SECUFOCUSNOW
Home›CVE index›CVE-2024-26865
Review reviewHigh

CVE-2024-26865

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: Fix use-after-free of net in reqsk_timer_handler(). syzkaller reported a warning of netns tracker [0] followed by KASAN splat [1] and another ref tracker warning [1]. syzkaller could not find a repro, but in the log, the only suspicious sequence was as follows: 18:26:22 executing program 1: r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) ... connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4001, 0x0, @loopback}, 0x1c) (async) The notable thing here is 0x4001 in connect(), which is RDS_TCP_PORT. So, the scenario would be: 1. u...

CVSS
7.8
EPSS
0.23%
13.8% percentile
CISA KEV
Not listed
Published
2024.04.17
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.23%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: Fix use-after-free of net in reqsk_timer_handler(). syzkaller reported a warning of netns tracker [0] followed by KASAN splat [1] and another ref tracker warning [1]. syzkaller could not find a repro, but in the log, the only suspicious sequence was as follows: 18:26:22 executing program 1: r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) ... connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4001, 0x0, @loopback}, 0x1c) (async) The notable thing here is 0x4001 in connect(), which is RDS_TCP_PORT. So, the scenario would be: 1. u...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= 467fa15356acfb7b2efa38839c3e76caa4e6e0ea < 9905a157048f441f1412e7bd13372f4a971d75c6, >= 467fa15356acfb7b2efa38839c3e76caa4e6e0ea < f901ee07853ce97e9f1104c7c898fbbe447f0279, >= 467fa15356acfb7b2efa38839c3e76caa4e6e0ea < 9ceac040506a05a30b104b2aa2e9146810704500, >= 467fa15356acfb7b2efa38839c3e76caa4e6e0ea < 1e9fd5cf8d7f487332560f7bb312fc7d416817f3, >= 467fa15356acfb7b2efa38839c3e76caa4e6e0ea < 2a750d6a5b365265dbda33330a6188547ddb5c24, >= 4.3, >= 4.3 < 6.1.83, >= 6.2 < 6.6.23, >= 6.7 < 6.7.11, >= 6.8 < 6.8.2
Fixed versions
6.1.83, 6.6.23, 6.7.11, 6.8.2

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-416