CVE-2024-26834

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-26834", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.181Z", "datePublished": "2024-04-17T10:10:02.282Z", "dateUpdated": "2026-08-05T11:27:43.870Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:27:43.870Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_flow_offload: release dst in case direct xmit path is used\n\nDirect xmit does not use it since it calls dev_queue_xmit() to send\npackets, hence it calls dst_release().\n\nkmemleak reports:\n\nunreferenced object 0xffff88814f440900 (size 184):\n comm \"softirq\", pid 0, jiffies 4294951896\n hex dump (first 32 bytes):\n 00 60 5b 04 81 88 ff ff 00 e6 e8 82 ff ff ff ff .`[.............\n 21 0b 50 82 ff ff ff ff 00 00 00 00 00 00 00 00 !.P.............\n backtrace (crc cb2bf5d6):\n [<000000003ee17107>] kmem_cache_alloc+0x286/0x340\n [<0000000021a5de2c>] dst_alloc+0x43/0xb0\n [<00000000f0671159>] rt_dst_alloc+0x2e/0x190\n [<00000000fe5092c9>] __mkroute_output+0x244/0x980\n [<000000005fb96fb0>] ip_route_output_flow+0xc0/0x160\n [<0000000045367433>] nf_ip_route+0xf/0x30\n [<0000000085da1d8e>] nf_route+0x2d/0x60\n [<00000000d1ecd1cb>] nft_flow_route+0x171/0x6a0 [nft_flow_offload]\n [<00000000d9b2fb60>] nft_flow_offload_eval+0x4e8/0x700 [nft_flow_offload]\n [<000000009f447dbb>] expr_call_ops_eval+0x53/0x330 [nf_tables]\n [<00000000072e1be6>] nft_do_chain+0x17c/0x840 [nf_tables]\n [<00000000d0551029>] nft_do_chain_inet+0xa1/0x210 [nf_tables]\n [<0000000097c9d5c6>] nf_hook_slow+0x5b/0x160\n [<0000000005eccab1>] ip_forward+0x8b6/0x9b0\n [<00000000553a269b>] ip_rcv+0x221/0x230\n [<00000000412872e5>] __netif_receive_skb_one_core+0xfe/0x110"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The expression is only valid on the `NF_INET_FORWARD` hook, so the leak is driven entirely by packets transiting the router \u2014 `ip_rcv` \u2192 `ip_forward` \u2192 `nft_do_chain` \u2192 `nft_flow_offload_eval`, exactly the kmemleak backtrace. Any remote host whose TCP/UDP traffic is routed through the box (port-forwarded service, DMZ host, or ordinary transit flow) triggers it, with no L2 adjacency required.\nAC:L - In the vulnerable configuration the leak is deterministic \u2014 every offloaded flow whose path resolves to `FLOW_OFFLOAD_XMIT_DIRECT` leaks its dst with no race, timing window, or memory-layout precondition, and the attacker controls the flow-creation rate by simply opening connections. The bridge-in-path and hardware-offload conditions that select direct xmit are the normal OpenWrt/consumer-router flowtable deployment, not a rare configuration.\nPR:N - Sending packets through a forwarding router requires no credentials, authentication, or account on the target; the conntrack entry and flow offload are created purely as a side effect of transit traffic. No privilege check exists anywhere between `netif_receive_skb` and `flow_offload_fill_route`.\nUI:N - The attacker's own packets drive the entire path; no administrator or user of the router needs to open a file, mount anything, or take any action for the leak to accumulate.\nS:U - The leaked `struct rtable` objects and the exhausted slab belong to the same kernel that contains the flawed code, and no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is a missing reference drop, so nothing is freed early, read out of bounds, or copied out \u2014 the orphaned dst is simply unreachable and no kernel data reaches userspace or any remote peer.\nI:N - An over-reference is the safe direction: no object is freed prematurely, overwritten, or type-confused, giving no write primitive and no influence over control flow. The offloaded flow itself continues to function correctly because direct xmit never needed the dst.\nA:H - The leak is unbounded and its rate is limited only by the unauthenticated attacker's packet rate \u2014 two packets per unique tuple permanently orphan up to two 184-byte `ip_dst_cache` objects, and neither conntrack expiry nor `nf_conntrack_max` reclaims them, so sustained transit traffic drives the router to memory exhaustion, OOM kill, and loss of forwarding. On IPv6 the inflated `dst_entries` count additionally keeps `fib6_run_gc()` permanently engaged and collapses `ip6_rt_gc_expire`, prematurely expiring legitimate routes."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nf_flow_table_core.c"], "versions": [{"version": "7c71b831220edeab7ce603d818dc1708d9ea4137", "lessThan": "13b57b5cd591d5b22f9bbf047b2922967de411f3", "status": "affected", "versionType": "git"}, {"version": "9c5662e95a8dcc232c3ef4deb21033badcd260f6", "lessThan": "a6cafdb49a7bbf4a88367db209703eee6941e023", "status": "affected", "versionType": "git"}, {"version": "fa502c86566680ac62bc28ec883a069bf7a2aa5e", "lessThan": "9256ab9232e35a16af9c30fa4e522e6d1bd3605a", "status": "affected", "versionType": "git"}, {"version": "fa502c86566680ac62bc28ec883a069bf7a2aa5e", "lessThan": "2d17cf10179a7de6d8f0128168b84ad0b4a1863f", "status": "affected", "versionType": "git"}, {"version": "fa502c86566680ac62bc28ec883a069bf7a2aa5e", "lessThan": "8762785f459be1cfe6fcf7285c123aad6a3703f0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nf_flow_table_core.c"], "versions": [{"version": "6.5", "status": "affected"}, {"version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.19", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.7", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.6.19"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.7.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/13b57b5cd591d5b22f9bbf047b2922967de411f3"}, {"url": "https://git.kernel.org/stable/c/a6cafdb49a7bbf4a88367db209703eee6941e023"}, {"url": "https://git.kernel.org/stable/c/9256ab9232e35a16af9c30fa4e522e6d1bd3605a"}, {"url": "https://git.kernel.org/stable/c/2d17cf10179a7de6d8f0128168b84ad0b4a1863f"}, {"url": "https://git.kernel.org/stable/c/8762785f459be1cfe6fcf7285c123aad6a3703f0"}], "title": "netfilter: nft_flow_offload: release dst in case direct xmit path is used", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-17T17:41:37.747801Z", "id": "CVE-2024-26834", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T17:48:34.642Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.630Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/13b57b5cd591d5b22f9bbf047b2922967de411f3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a6cafdb49a7bbf4a88367db209703eee6941e023", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9256ab9232e35a16af9c30fa4e522e6d1bd3605a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2d17cf10179a7de6d8f0128168b84ad0b4a1863f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8762785f459be1cfe6fcf7285c123aad6a3703f0", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/13b57b5cd591d5b22f9bbf047b2922967de411f3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a6cafdb49a7bbf4a88367db209703eee6941e023", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9256ab9232e35a16af9c30fa4e522e6d1bd3605a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2d17cf10179a7de6d8f0128168b84ad0b4a1863f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8762785f459be1cfe6fcf7285c123aad6a3703f0", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.630Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26834", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-17T17:41:37.747801Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T17:41:38.743Z"}}], "cna": {"title": "netfilter: nft_flow_offload: release dst in case direct xmit path is used", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The expression is only valid on the `NF_INET_FORWARD` hook, so the leak is driven entirely by packets transiting the router \u2014 `ip_rcv` \u2192 `ip_forward` \u2192 `nft_do_chain` \u2192 `nft_flow_offload_eval`, exactly the kmemleak backtrace. Any remote host whose TCP/UDP traffic is routed through the box (port-forwarded service, DMZ host, or ordinary transit flow) triggers it, with no L2 adjacency required.\nAC:L - In the vulnerable configuration the leak is deterministic \u2014 every offloaded flow whose path resolves to `FLOW_OFFLOAD_XMIT_DIRECT` leaks its dst with no race, timing window, or memory-layout precondition, and the attacker controls the flow-creation rate by simply opening connections. The bridge-in-path and hardware-offload conditions that select direct xmit are the normal OpenWrt/consumer-router flowtable deployment, not a rare configuration.\nPR:N - Sending packets through a forwarding router requires no credentials, authentication, or account on the target; the conntrack entry and flow offload are created purely as a side effect of transit traffic. No privilege check exists anywhere between `netif_receive_skb` and `flow_offload_fill_route`.\nUI:N - The attacker's own packets drive the entire path; no administrator or user of the router needs to open a file, mount anything, or take any action for the leak to accumulate.\nS:U - The leaked `struct rtable` objects and the exhausted slab belong to the same kernel that contains the flawed code, and no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is a missing reference drop, so nothing is freed early, read out of bounds, or copied out \u2014 the orphaned dst is simply unreachable and no kernel data reaches userspace or any remote peer.\nI:N - An over-reference is the safe direction: no object is freed prematurely, overwritten, or type-confused, giving no write primitive and no influence over control flow. The offloaded flow itself continues to function correctly because direct xmit never needed the dst.\nA:H - The leak is unbounded and its rate is limited only by the unauthenticated attacker's packet rate \u2014 two packets per unique tuple permanently orphan up to two 184-byte `ip_dst_cache` objects, and neither conntrack expiry nor `nf_conntrack_max` reclaims them, so sustained transit traffic drives the router to memory exhaustion, OOM kill, and loss of forwarding. On IPv6 the inflated `dst_entries` count additionally keeps `fib6_run_gc()` permanently engaged and collapses `ip6_rt_gc_expire`, prematurely expiring legitimate routes."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7c71b831220edeab7ce603d818dc1708d9ea4137", "lessThan": "13b57b5cd591d5b22f9bbf047b2922967de411f3", "versionType": "git"}, {"status": "affected", "version": "9c5662e95a8dcc232c3ef4deb21033badcd260f6", "lessThan": "a6cafdb49a7bbf4a88367db209703eee6941e023", "versionType": "git"}, {"status": "affected", "version": "fa502c86566680ac62bc28ec883a069bf7a2aa5e", "lessThan": "9256ab9232e35a16af9c30fa4e522e6d1bd3605a", "versionType": "git"}, {"status": "affected", "version": "fa502c86566680ac62bc28ec883a069bf7a2aa5e", "lessThan": "2d17cf10179a7de6d8f0128168b84ad0b4a1863f", "versionType": "git"}, {"status": "affected", "version": "fa502c86566680ac62bc28ec883a069bf7a2aa5e", "lessThan": "8762785f459be1cfe6fcf7285c123aad6a3703f0", "versionType": "git"}], "programFiles": ["net/netfilter/nf_flow_table_core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"status": "unaffected", "version": "0", "lessThan": "6.5", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.19", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.7", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/netfilter/nf_flow_table_core.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/13b57b5cd591d5b22f9bbf047b2922967de411f3"}, {"url": "https://git.kernel.org/stable/c/a6cafdb49a7bbf4a88367db209703eee6941e023"}, {"url": "https://git.kernel.org/stable/c/9256ab9232e35a16af9c30fa4e522e6d1bd3605a"}, {"url": "https://git.kernel.org/stable/c/2d17cf10179a7de6d8f0128168b84ad0b4a1863f"}, {"url": "https://git.kernel.org/stable/c/8762785f459be1cfe6fcf7285c123aad6a3703f0"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_flow_offload: release dst in case direct xmit path is used\n\nDirect xmit does not use it since it calls dev_queue_xmit() to send\npackets, hence it calls dst_release().\n\nkmemleak reports:\n\nunreferenced object 0xffff88814f440900 (size 184):\n comm \"softirq\", pid 0, jiffies 4294951896\n hex dump (first 32 bytes):\n 00 60 5b 04 81 88 ff ff 00 e6 e8 82 ff ff ff ff .`[.............\n 21 0b 50 82 ff ff ff ff 00 00 00 00 00 00 00 00 !.P.............\n backtrace (crc cb2bf5d6):\n [<000000003ee17107>] kmem_cache_alloc+0x286/0x340\n [<0000000021a5de2c>] dst_alloc+0x43/0xb0\n [<00000000f0671159>] rt_dst_alloc+0x2e/0x190\n [<00000000fe5092c9>] __mkroute_output+0x244/0x980\n [<000000005fb96fb0>] ip_route_output_flow+0xc0/0x160\n [<0000000045367433>] nf_ip_route+0xf/0x30\n [<0000000085da1d8e>] nf_route+0x2d/0x60\n [<00000000d1ecd1cb>] nft_flow_route+0x171/0x6a0 [nft_flow_offload]\n [<00000000d9b2fb60>] nft_flow_offload_eval+0x4e8/0x700 [nft_flow_offload]\n [<000000009f447dbb>] expr_call_ops_eval+0x53/0x330 [nf_tables]\n [<00000000072e1be6>] nft_do_chain+0x17c/0x840 [nf_tables]\n [<00000000d0551029>] nft_do_chain_inet+0xa1/0x210 [nf_tables]\n [<0000000097c9d5c6>] nf_hook_slow+0x5b/0x160\n [<0000000005eccab1>] ip_forward+0x8b6/0x9b0\n [<00000000553a269b>] ip_rcv+0x221/0x230\n [<00000000412872e5>] __netif_receive_skb_one_core+0xfe/0x110"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.19", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.7", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "6.5"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:27:43.870Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26834", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:27:43.870Z", "dateReserved": "2024-02-19T14:20:24.181Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-17T10:10:02.282Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/netfilter/nf_flow_table_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "13b57b5cd591d5b22f9bbf047b2922967de411f3", "status": "affected", "version": "7c71b831220edeab7ce603d818dc1708d9ea4137", "versionType": "git"}, {"lessThan": "a6cafdb49a7bbf4a88367db209703eee6941e023", "status": "affected", "version": "9c5662e95a8dcc232c3ef4deb21033badcd260f6", "versionType": "git"}, {"lessThan": "9256ab9232e35a16af9c30fa4e522e6d1bd3605a", "status": "affected", "version": "fa502c86566680ac62bc28ec883a069bf7a2aa5e", "versionType": "git"}, {"lessThan": "2d17cf10179a7de6d8f0128168b84ad0b4a1863f", "status": "affected", "version": "fa502c86566680ac62bc28ec883a069bf7a2aa5e", "versionType": "git"}, {"lessThan": "8762785f459be1cfe6fcf7285c123aad6a3703f0", "status": "affected", "version": "fa502c86566680ac62bc28ec883a069bf7a2aa5e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/netfilter/nf_flow_table_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"lessThan": "6.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.19", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A0B51637-34FC-474F-8640-2361C61E7DD2", "versionEndExcluding": "6.6.19", "versionStartIncluding": "6.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "575EE16B-67F2-4B5B-B5F8-1877715C898B", "versionEndExcluding": "6.7.7", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*", "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*", "matchCriteriaId": "056BD938-0A27-4569-B391-30578B309EE3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*", "matchCriteriaId": "F02056A5-B362-4370-9FF8-6F0BD384D520", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*", "matchCriteriaId": "62075ACE-B2A0-4B16-829D-B3DA5AE5CC41", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*", "matchCriteriaId": "A780F817-2A77-4130-A9B7-5C25606314E3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_flow_offload: release dst in case direct xmit path is used\n\nDirect xmit does not use it since it calls dev_queue_xmit() to send\npackets, hence it calls dst_release().\n\nkmemleak reports:\n\nunreferenced object 0xffff88814f440900 (size 184):\n comm \"softirq\", pid 0, jiffies 4294951896\n hex dump (first 32 bytes):\n 00 60 5b 04 81 88 ff ff 00 e6 e8 82 ff ff ff ff .`[.............\n 21 0b 50 82 ff ff ff ff 00 00 00 00 00 00 00 00 !.P.............\n backtrace (crc cb2bf5d6):\n [<000000003ee17107>] kmem_cache_alloc+0x286/0x340\n [<0000000021a5de2c>] dst_alloc+0x43/0xb0\n [<00000000f0671159>] rt_dst_alloc+0x2e/0x190\n [<00000000fe5092c9>] __mkroute_output+0x244/0x980\n [<000000005fb96fb0>] ip_route_output_flow+0xc0/0x160\n [<0000000045367433>] nf_ip_route+0xf/0x30\n [<0000000085da1d8e>] nf_route+0x2d/0x60\n [<00000000d1ecd1cb>] nft_flow_route+0x171/0x6a0 [nft_flow_offload]\n [<00000000d9b2fb60>] nft_flow_offload_eval+0x4e8/0x700 [nft_flow_offload]\n [<000000009f447dbb>] expr_call_ops_eval+0x53/0x330 [nf_tables]\n [<00000000072e1be6>] nft_do_chain+0x17c/0x840 [nf_tables]\n [<00000000d0551029>] nft_do_chain_inet+0xa1/0x210 [nf_tables]\n [<0000000097c9d5c6>] nf_hook_slow+0x5b/0x160\n [<0000000005eccab1>] ip_forward+0x8b6/0x9b0\n [<00000000553a269b>] ip_rcv+0x221/0x230\n [<00000000412872e5>] __netif_receive_skb_one_core+0xfe/0x110"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nft_flow_offload: libera dst en caso de que se use la ruta de xmit directa Direct xmit no la usa ya que llama a dev_queue_xmit() para enviar paquetes, por lo tanto llama a dst_release(). informes kmemleak: objeto sin referencia 0xffff88814f440900 (tama\u00f1o 184): comm \"softirq\", pid 0, jiffies 4294951896 volcado hexadecimal (primeros 32 bytes): 00 60 5b 04 81 88 ff ff 00 e6 e8 82 ff ff ff ff .`[.. ........... 21 0b 50 82 ff ff ff ff 00 00 00 00 00 00 00 00 !.P................. retroceso (crc cb2bf5d6): [ &lt;000000003ee17107&gt;] kmem_cache_alloc+0x286/0x340 [&lt;0000000021a5de2c&gt;] dst_alloc+0x43/0xb0 [&lt;00000000f0671159&gt;] rt_dst_alloc+0x2e/0x190 [&lt;00000000fe50 92c9&gt;] __mkroute_output+0x244/0x980 [&lt;000000005fb96fb0&gt;] ip_route_output_flow+0xc0/0x160 [ &lt;0000000045367433&gt;] nf_ip_route+0xf/0x30 [&lt;0000000085da1d8e&gt;] nf_route+0x2d/0x60 [&lt;00000000d1ecd1cb&gt;] nft_flow_route+0x171/0x6a0 [nft_flow_offload] 0000d9b2fb60&gt;] nft_flow_offload_eval+0x4e8/0x700 [nft_flow_offload] [&lt;000000009f447dbb&gt;] expr_call_ops_eval+0x53/0x330 [nf_tables] [&lt;00000000072e1be6&gt;] nft_do_chain+0x17c/0x840 [nf_tables] [&lt;00000000d0551029&gt;] nft_do_chain_inet+0xa1/0x210 [nf_tables] [ &lt;0000000097c9d5c6&gt;] nf_hook_slow+0x5b/0x160 [&lt;0000000005eccab1&gt;] ip_forward +0x8b6/0x9b0 [&lt;00000000553a269b&gt;] ip_rcv+0x221/0x230 [&lt;00000000412872e5&gt;] __netif_receive_skb_one_core+0xfe/0x110"}], "id": "CVE-2024-26834", "lastModified": "2026-08-04T11:17:12.010", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-26834", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-06-17T17:41:37.747801Z", "version": "2.0.3"}}]}, "published": "2024-04-17T10:15:09.617", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/13b57b5cd591d5b22f9bbf047b2922967de411f3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2d17cf10179a7de6d8f0128168b84ad0b4a1863f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8762785f459be1cfe6fcf7285c123aad6a3703f0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9256ab9232e35a16af9c30fa4e522e6d1bd3605a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a6cafdb49a7bbf4a88367db209703eee6941e023"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/13b57b5cd591d5b22f9bbf047b2922967de411f3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2d17cf10179a7de6d8f0128168b84ad0b4a1863f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8762785f459be1cfe6fcf7285c123aad6a3703f0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9256ab9232e35a16af9c30fa4e522e6d1bd3605a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a6cafdb49a7bbf4a88367db209703eee6941e023"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: netfilter: nft_flow_offload: release dst in case direct xmit path is used", "id": "2275586", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2275586"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-402", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnetfilter: nft_flow_offload: release dst in case direct xmit path is used\nDirect xmit does not use it since it calls dev_queue_xmit() to send\npackets, hence it calls dst_release().\nkmemleak reports:\nunreferenced object 0xffff88814f440900 (size 184):\ncomm \"softirq\", pid 0, jiffies 4294951896\nhex dump (first 32 bytes):\n00 60 5b 04 81 88 ff ff 00 e6 e8 82 ff ff ff ff .`[.............\n21 0b 50 82 ff ff ff ff 00 00 00 00 00 00 00 00 !.P.............\nbacktrace (crc cb2bf5d6):\n[<000000003ee17107>] kmem_cache_alloc+0x286/0x340\n[<0000000021a5de2c>] dst_alloc+0x43/0xb0\n[<00000000f0671159>] rt_dst_alloc+0x2e/0x190\n[<00000000fe5092c9>] __mkroute_output+0x244/0x980\n[<000000005fb96fb0>] ip_route_output_flow+0xc0/0x160\n[<0000000045367433>] nf_ip_route+0xf/0x30\n[<0000000085da1d8e>] nf_route+0x2d/0x60\n[<00000000d1ecd1cb>] nft_flow_route+0x171/0x6a0 [nft_flow_offload]\n[<00000000d9b2fb60>] nft_flow_offload_eval+0x4e8/0x700 [nft_flow_offload]\n[<000000009f447dbb>] expr_call_ops_eval+0x53/0x330 [nf_tables]\n[<00000000072e1be6>] nft_do_chain+0x17c/0x840 [nf_tables]\n[<00000000d0551029>] nft_do_chain_inet+0xa1/0x210 [nf_tables]\n[<0000000097c9d5c6>] nf_hook_slow+0x5b/0x160\n[<0000000005eccab1>] ip_forward+0x8b6/0x9b0\n[<00000000553a269b>] ip_rcv+0x221/0x230\n[<00000000412872e5>] __netif_receive_skb_one_core+0xfe/0x110"], "name": "CVE-2024-26834", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26834\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26834\nhttps://lore.kernel.org/linux-cve-announce/2024041714-CVE-2024-26834-a73b@gregkh/T"], "threat_severity": "Low"}

{}