CVE-2024-26961 — Use After Free in Linux
Severity
7.8HIGHNVD
OSV5.5
EPSS
0.0%
top 96.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 1
Latest updateSep 18
Description
In the Linux kernel, the following vulnerability has been resolved:
mac802154: fix llsec key resources release in mac802154_llsec_key_del
mac802154_llsec_key_del() can free resources of a key directly without
following the RCU rules for waiting before the end of a grace period. This
may lead to use-after-free in case llsec_lookup_key() is traversing the
list of keys in parallel with a key deletion:
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 4 PID: 16000 at lib/refcount.c:25 refc…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages13 packages
▶CVEListV5linux/linux5d637d5aabd85132bd85779677d8acb708e0ed90 — 068ab2759bc0b4daf0b964de61b2731449c86531+7
Patches
🔴Vulnerability Details
15📋Vendor Advisories
16💬Community
1Bugzilla▶
CVE-2024-26961 kernel: mac802154: fix llsec key resources release in mac802154_llsec_key_del↗2024-05-01