tunnels: fix out of bounds access when building IPv6 PMTU error

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2024-26665
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2024-04-02 07:15:43 UTC
Updated2026-08-04 11:16:55 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: tunnels: fix out of bounds access when building IPv6 PMTU error If the ICMPv6 error is built from a non-linear skb we get the following splat, BUG: KASAN: slab-out-of-bounds in do_csum+0x220/0x240 Read of size 4 at addr ffff88811d402c80 by task netperf/820 CPU: 0 PID: 820 Comm: netperf Not tainted 6.8.0-rc1+ #543 ... kasan_report+0xd8/0x110 do_csum+0x220/0x240 csum_partial+0xc/0x20 skb_tunnel_check_pmtu+0xeb9/0x3280 vxlan_xmit_one+0x14c2/0x4080 vxlan_xmit+0xf61/0x5c00 dev_hard_start_xmit+0xfb/0x510 __dev_queue_xmit+0x7cd/0x32a0 br_dev_queue_push_xmit+0x39d/0x6a0 Use skb_checksum instead of csum_partial who cannot deal with non-linear SKBs.

Risk And Classification

Primary CVSS: v3.1 7.1 HIGH from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Problem Types: CWE-125

VersionSourceTypeScoreSeverityVector
3.1[email protected]Primary7.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary9.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
3.1CNADECLARED9.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 4cb47a8644cc9eb8ec81190a50e79e6530d0297f e77bf828f1ca1c47fcff58bdc26b60a9d3dfbe1d git Not specified
CNA Linux Linux affected 4cb47a8644cc9eb8ec81190a50e79e6530d0297f d964dd1bc1452594b4207d9229c157d9386e5d8a git Not specified
CNA Linux Linux affected 4cb47a8644cc9eb8ec81190a50e79e6530d0297f e37cde7a5716466ff2a76f7f27f0a29b05b9a732 git Not specified
CNA Linux Linux affected 4cb47a8644cc9eb8ec81190a50e79e6530d0297f 510c869ffa4068c5f19ff4df51d1e2f3a30aaac1 git Not specified
CNA Linux Linux affected 4cb47a8644cc9eb8ec81190a50e79e6530d0297f 7dc9feb8b1705cf00de20563b6bc4831f4c99dab git Not specified
CNA Linux Linux affected 4cb47a8644cc9eb8ec81190a50e79e6530d0297f d75abeec401f8c86b470e7028a13fcdc87e5dd06 git Not specified
CNA Linux Linux affected 5.9 Not specified
CNA Linux Linux unaffected 5.9 semver Not specified
CNA Linux Linux unaffected 5.10.210 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.149 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.78 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.17 6.6.* semver Not specified
CNA Linux Linux unaffected 6.7.5 6.7.* semver Not specified
CNA Linux Linux unaffected 6.8 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
lists.debian.org/debian-lts-announce/2024/06/msg00017.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org Mailing List
git.kernel.org/stable/c/d964dd1bc1452594b4207d9229c157d9386e5d8a af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/d75abeec401f8c86b470e7028a13fcdc87e5dd06 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/510c869ffa4068c5f19ff4df51d1e2f3a30aaac1 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/7dc9feb8b1705cf00de20563b6bc4831f4c99dab af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/e77bf828f1ca1c47fcff58bdc26b60a9d3dfbe1d af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/e37cde7a5716466ff2a76f7f27f0a29b05b9a732 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Legacy QID Mappings

  • 6000567 Debian Security Update for linux (DSA 5658-1)

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report