Vulnerability · Published Apr 3, 2024 · Assigned by Linux
CVE-2024-26739net/sched: act_mirred: don't override retval if we already lost the skb
High 7.8
In plain English
A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.3%top 79.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mirred: don't override retval if we already lost the skb If we're redirecting the skb, and haven't called tcf_mirred_forward(), yet, we need to tell the core to drop the skb by setting the retcode to SHOT. If we have called tcf_mirred_forward(), however, the skb is out of our hands and returning SHOT will lead to UaF. Move the retval override to the error path which actually need it.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | bpftool | 7.3.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-64k | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-64k-core | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-64k-debug | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-64k-debug-core | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-64k-debug-devel | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-64k-debug-devel-matched | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-64k-debug-modules | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-64k-debug-modules-core | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-64k-debug-modules-extra | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-64k-devel | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-64k-devel-matched | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-64k-modules | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-64k-modules-core | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-64k-modules-extra | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-abi-stablelists | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-core | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-cross-headers | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-debug | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-debug-core | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-debug-devel | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-debug-devel-matched | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-debug-modules | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-debug-modules-core | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-debug-modules-extra | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-debug-uki-virt | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-devel | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-devel-matched | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-doc | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-headers | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-modules | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-modules-core | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-modules-extra | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-rt | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-rt-core | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-rt-debug | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-rt-debug-core | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-rt-debug-devel | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-rt-debug-modules | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-rt-debug-modules-core | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-rt-debug-modules-extra | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-rt-devel | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-rt-modules | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-rt-modules-core | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-rt-modules-extra | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-tools | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-tools-libs | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-tools-libs-devel | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-uki-virt | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-zfcpdump | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-zfcpdump-core | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-zfcpdump-devel | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-zfcpdump-devel-matched | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-zfcpdump-modules | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-zfcpdump-modules-core | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | kernel-zfcpdump-modules-extra | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | libperf | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | perf | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | python3-perf | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | rtla | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| AlmaLinux:9 | rv | 5.14.0-427.37.1.el9_4 | ALSA-2024:6997 |
| Debian:12 | linux | 6.1.137-1 | DEBIAN-CVE-2024-26739 |
| Debian:13 | linux | 6.7.7-1 | DEBIAN-CVE-2024-26739 |
| Debian:14 | linux | 6.7.7-1 | DEBIAN-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux | 5.15.0-144.157 | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux | 5.15.0-144.157 | USN-7654-1 |
| Ubuntu:22.04:LTS | linux-allwinner-5.19 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-aws | 5.15.0-1088.95 | USN-7654-1 |
| Ubuntu:22.04:LTS | linux-aws | 5.15.0-1088.95 | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-aws-5.19 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-aws-6.2 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-aws-6.5 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-azure | 5.15.0-1094.103 | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-azure | 5.15.0-1094.103 | USN-7711-1 |
| Ubuntu:22.04:LTS | linux-azure-5.19 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-azure-6.2 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-azure-6.5 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-azure-fde | 5.15.0-1094.103.1 | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-azure-fde-5.19 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-azure-fde-6.2 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-gcp | 5.15.0-1087.96 | USN-7654-1 |
| Ubuntu:22.04:LTS | linux-gcp | 5.15.0-1087.96 | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-gcp-5.19 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-gcp-6.2 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-gcp-6.5 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-gke | 5.15.0-1085.91 | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-gke | 5.15.0-1085.91 | USN-7654-1 |
| Ubuntu:22.04:LTS | linux-gkeop | 5.15.0-1070.78 | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-gkeop | 5.15.0-1070.78 | USN-7654-1 |
| Ubuntu:22.04:LTS | linux-hwe-5.19 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-hwe-6.2 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-hwe-6.5 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-ibm | 5.15.0-1080.83 | USN-7654-1 |
| Ubuntu:22.04:LTS | linux-ibm | 5.15.0-1080.83 | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-intel-iotg | 5.15.0-1083.89 | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-intel-iotg | 5.15.0-1083.89 | USN-7654-1 |
| Ubuntu:22.04:LTS | linux-kvm | 5.15.0-1084.89 | USN-7654-4 |
| Ubuntu:22.04:LTS | linux-kvm | 5.15.0-1084.89 | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-lowlatency | 5.15.0-144.157 | USN-7654-1 |
| Ubuntu:22.04:LTS | linux-lowlatency | 5.15.0-144.157 | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-5.19 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.2 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.5 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-nvidia | 5.15.0-1082.83 | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-nvidia | 5.15.0-1082.83 | USN-7654-1 |
| Ubuntu:22.04:LTS | linux-nvidia-6.2 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-nvidia-6.5 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-nvidia-tegra | 5.15.0-1041.41 | USN-7654-1 |
| Ubuntu:22.04:LTS | linux-nvidia-tegra | 5.15.0-1041.41 | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-nvidia-tegra-igx | 5.15.0-1030.30 | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-nvidia-tegra-igx | 5.15.0-1030.30 | USN-7654-1 |
| Ubuntu:22.04:LTS | linux-oem-5.17 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-oem-6.0 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-oem-6.1 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-oem-6.5 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-oracle | 5.15.0-1085.91 | USN-7654-1 |
| Ubuntu:22.04:LTS | linux-oracle | 5.15.0-1085.91 | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-oracle-6.5 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-raspi | 5.15.0-1083.86 | USN-7686-1 |
| Ubuntu:22.04:LTS | linux-raspi | 5.15.0-1083.86 | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-riscv | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-riscv-5.19 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-riscv-6.5 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-starfive-5.19 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-starfive-6.2 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-starfive-6.5 | no fix listed | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-xilinx-zynqmp | 5.15.0-1052.56 | UBUNTU-CVE-2024-26739 |
| Ubuntu:22.04:LTS | linux-xilinx-zynqmp | 5.15.0-1052.56 | USN-7654-5 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | e5cf1baf92cb785b90390db1c624948e70c8b8bd – before 0117fe0a4615a7c8d30d6ebcbf87332fbe63e6fde5cf1baf92cb785b90390db1c624948e70c8b8bd – before 9d3ef89b6a5e9f2e940de2cef3d543be0be8dec5e5cf1baf92cb785b90390db1c624948e70c8b8bd – before e873e8f7d03a2ee5b77fb1a305c782fed98e2754e5cf1baf92cb785b90390db1c624948e70c8b8bd – before 28cdbbd38a4413b8eff53399b3f872fd4e80db9de5cf1baf92cb785b90390db1c624948e70c8b8bd – before f4e294bbdca8ac8757db436fc82214f3882fc7e7e5cf1baf92cb785b90390db1c624948e70c8b8bd – before 166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 |
| Linux | Linux | 4.19 |
References
- https://git.kernel.org/stable/c/0117fe0a4615a7c8d30d6ebcbf87332fbe63e6fd
- https://git.kernel.org/stable/c/9d3ef89b6a5e9f2e940de2cef3d543be0be8dec5
- https://git.kernel.org/stable/c/e873e8f7d03a2ee5b77fb1a305c782fed98e2754
- https://git.kernel.org/stable/c/28cdbbd38a4413b8eff53399b3f872fd4e80db9d
- https://git.kernel.org/stable/c/f4e294bbdca8ac8757db436fc82214f3882fc7e7
- https://git.kernel.org/stable/c/166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html