CVE-2024-26961

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix llsec key resources release in mac802154_llsec_key_del mac802154_llsec_key_del() can free resources of a key directly without following the RCU rules for waiting before the end of a grace period. This may lead to use-after-free in case llsec_lookup_key() is traversing the list of keys in parallel with a key deletion: refcount_t: addition on 0; use-after-free. WARNING: CPU: 4 PID: 16000 at lib/refcount.c:25 refcount_warn_saturate+0x162/0x2a0 Modules linked in: CPU: 4 PID: 16000 Comm: wpan-ping Not tainted 6.7....

Affected product and versions

Product

Linux Linux, SIMATIC S7-1500 TM MFP - GNU/Linux subsystem, linux kernel

Affected versions

>= 5d637d5aabd85132bd85779677d8acb708e0ed90 < 068ab2759bc0b4daf0b964de61b2731449c86531, >= 5d637d5aabd85132bd85779677d8acb708e0ed90 < d3d858650933d44ac12c1f31337e7110c2071821, >= 5d637d5aabd85132bd85779677d8acb708e0ed90 < dcd51ab42b7a0431575689c5f74b8b6efd45fc2f, >= 5d637d5aabd85132bd85779677d8acb708e0ed90 < 20d3e1c8a1847497269f04d874b2a5818ec29e2d, >= 5d637d5aabd85132bd85779677d8acb708e0ed90 < 640297c3e897bd7e1481466a6a5cb9560f1edb88, >= 5d637d5aabd85132bd85779677d8acb708e0ed90 < 49c8951680d7b76fceaee89dcfbab1363fb24fd1, >= 5d637d5aabd85132bd85779677d8acb708e0ed90 < e8a1e58345cf40b7b272e08ac7b32328b2543e40, >= 3.16, >= 3.16 < 5.10.215, >= 5.11 < 5.15.154, >= 5.16 < 6.1.84, >= 6.2 < 6.6.24, >= 6.7 < 6.7.12, >= 6.8 < 6.8.3

Fixed versions

5.10.215, 5.15.154, 6.1.84, 6.6.24, 6.7.12, 6.8.3

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416