CVE-2024-26849

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netlink: add nla be16/32 types to minlen array

BUG: KMSAN: uninit-value in nla_validate_range_unsigned lib/nlattr.c:222 [inline] BUG: KMSAN: uninit-value in nla_validate_int_range lib/nlattr.c:336 [inline] BUG: KMSAN: uninit-value in validate_nla lib/nlattr.c:575 [inline] BUG: KMSAN: uninit-value in __nla_validate_parse+0x2e20/0x45c0 lib/nlattr.c:631 nla_validate_range_unsigned lib/nlattr.c:222 [inline] nla_validate_int_range lib/nlattr.c:336 [inline] validate_nla lib/nlattr.c:575 [inline] ...

The message in question matches this policy:

[NFTA_TARGET_REV] = NLA_POLICY_MAX(NLA_BE32, 255),

but because NLA_BE32 size in minlen array is 0, the validation code will read past the malformed (too small) attribute.

Note: Other attributes, e.g. BITFIELD32, SINT, UINT.. are also missing: those likely should be added too.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-908

Affected software

VendorProductVersions
LinuxLinux>= 24ea1c8abaae6541ad95912422a9af4fb858428d, < 000a68159c0326b46c42ec712ab98793e7e625a7; >= cbfac0add2afe8960a09806012313765a2179423, < 80b40f9cb87f3bf5877dfb852765cf92bc03ca77; >= ecaf75ffd5f5db320d8b1da0198eef5a5ce64a3f, < 0ac219c4c3ab253f3981f346903458d20bacab32; >= ecaf75ffd5f5db320d8b1da0198eef5a5ce64a3f, < a2ab028151841cd833cb53eb99427e0cc990112d; >= ecaf75ffd5f5db320d8b1da0198eef5a5ce64a3f, < 7a9d14c63b35f89563c5ecbadf918ad64979712d; >= ecaf75ffd5f5db320d8b1da0198eef5a5ce64a3f, < 9a0d18853c280f6a0ee99f91619f2442a17a323a
LinuxLinux6.1

References

Timeline

Published
Apr 17, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-26856.1A vulnerability, which was classified as problematic, was found in Campcodes Online Job Finder System 1.0. This affects an unknown part of tCVE-2024-268505.5In the Linux kernel, the following vulnerability has been resolved: mm/debug_vm_pgtable: fix BUG_ON with pud advanced test Architectures lCVE-2024-268515.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: Add protection for bmp length out of rangCVE-2024-268527.8In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() syzbot found CVE-2024-268535.5In the Linux kernel, the following vulnerability has been resolved: igc: avoid returning frame twice in XDP_REDIRECT When a frame can not CVE-2024-268547.5In the Linux kernel, the following vulnerability has been resolved: ice: fix uninitialized dplls mutex usage The pf->dplls.lock mutex is iCVE-2024-268555.5In the Linux kernel, the following vulnerability has been resolved: net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink(CVE-2024-268567.8In the Linux kernel, the following vulnerability has been resolved: net: sparx5: Fix use after free inside sparx5_del_mact_entry Based on CVE-2024-268577.3In the Linux kernel, the following vulnerability has been resolved: geneve: make sure to pull inner header in geneve_rx() syzbot triggeredCVE-2024-268585.5In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission trackCVE-2024-268594.7In the Linux kernel, the following vulnerability has been resolved: net/bnx2x: Prevent access to a freed page in page_pool Fix race conditCVE-2024-26866.1A vulnerability has been found in Campcodes Online Job Finder System 1.0 and classified as problematic. This vulnerability affects unknown c
CVE-2024-26849: Medium severity, CVSS 5.5 | Vulnix