CVE-2024-26856

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-26856", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.183Z", "datePublished": "2024-04-17T10:17:18.475Z", "dateUpdated": "2026-08-05T11:27:50.303Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:27:50.303Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sparx5: Fix use after free inside sparx5_del_mact_entry\n\nBased on the static analyzis of the code it looks like when an entry\nfrom the MAC table was removed, the entry was still used after being\nfreed. More precise the vid of the mac_entry was used after calling\ndevm_kfree on the mac_entry.\nThe fix consists in first using the vid of the mac_entry to delete the\nentry from the HW and after that to free it."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerability is driven by Ethernet frames on the L2 segment \u2014 an unauthenticated attacker connected to a Sparx5 switch port populates the MAC table with chosen source MACs, and a MAC roam or FDB age-out makes the bridge emit SWITCHDEV_FDB_DEL_TO_DEVICE into sparx5_del_mact_entry(). No routing is involved, so this is same-broadcast-domain (Adjacent) rather than Network.\nAC:L - The free-then-use is unconditional straight-line code, not a race \u2014 every matching entry deletion frees mact_entry and then reads mact_entry->vid. The attacker controls both the MAC/VID that populates the table and the trigger (moving the same source MAC between ports forces br_fdb_update() to emit the delete notification synchronously), so it is reproducible on demand.\nPR:N - The frame-driven path requires no credentials or account on the switch whatsoever \u2014 MAC learning, roaming, and FDB aging are automatic. The privileged `bridge fdb del` route is only an alternative, strictly weaker trigger.\nUI:N - No victim action is needed; bridge MAC learning, roaming and aging happen automatically in response to attacker-sent frames on an already-configured bridged switch port.\nS:U - The freed object and the corrupted state are both kernel-resident within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - Freed slab memory is read back and acted upon, and the object lives in a general kmalloc cache that concurrent GFP_ATOMIC softirq allocations (including the driver's own attacker-driven switchdev work and skb allocations) can immediately reoccupy, letting an attacker influence and infer freed heap contents. Per use-after-free scoring, UAF primitives generalize to kernel memory disclosure.\nI:H - The stale value read from freed memory is written directly into the hardware MAC-table unlearn command, so the wrong VID is unlearned \u2014 the attacker's revoked MAC stays programmed and forwarded in hardware while an unrelated victim's entry can be purged, corrupting switch forwarding and isolation state. As a use-after-free it also carries the general potential for heap-grooming-based write primitives.\nA:H - Dereferencing freed slab memory can oops outright \u2014 the kfree() immediately preceding the read can discard the last-in-use slab page back to the page allocator \u2014 and KASAN/hardened kernels report or panic on it. The attacker can retrigger it continuously by flooding frames with rotating source MACs, and corrupted MAC-table state causes persistent forwarding breakage."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c"], "versions": [{"version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "lessThan": "e46274df1100fb0c06704195bfff5bfbd418bf64", "status": "affected", "versionType": "git"}, {"version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "lessThan": "0de693d68b0a18d5e256556c7c62d92cca35ad52", "status": "affected", "versionType": "git"}, {"version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "lessThan": "e83bebb718fd1f42549358730e1206164e0861d6", "status": "affected", "versionType": "git"}, {"version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "lessThan": "71809805b95052ff551922f11660008fb3666025", "status": "affected", "versionType": "git"}, {"version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "lessThan": "89d72d4125e94aa3c2140fedd97ce07ba9e37674", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c"], "versions": [{"version": "5.14", "status": "affected"}, {"version": "0", "lessThan": "5.14", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.152", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.82", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.22", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.10", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "5.15.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.1.82"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.6.22"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.7.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e46274df1100fb0c06704195bfff5bfbd418bf64"}, {"url": "https://git.kernel.org/stable/c/0de693d68b0a18d5e256556c7c62d92cca35ad52"}, {"url": "https://git.kernel.org/stable/c/e83bebb718fd1f42549358730e1206164e0861d6"}, {"url": "https://git.kernel.org/stable/c/71809805b95052ff551922f11660008fb3666025"}, {"url": "https://git.kernel.org/stable/c/89d72d4125e94aa3c2140fedd97ce07ba9e37674"}], "title": "net: sparx5: Fix use after free inside sparx5_del_mact_entry", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26856", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-01T19:36:26.233327Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:49:15.853Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.666Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/e46274df1100fb0c06704195bfff5bfbd418bf64", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0de693d68b0a18d5e256556c7c62d92cca35ad52", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e83bebb718fd1f42549358730e1206164e0861d6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/71809805b95052ff551922f11660008fb3666025", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/89d72d4125e94aa3c2140fedd97ce07ba9e37674", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/e46274df1100fb0c06704195bfff5bfbd418bf64", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0de693d68b0a18d5e256556c7c62d92cca35ad52", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e83bebb718fd1f42549358730e1206164e0861d6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/71809805b95052ff551922f11660008fb3666025", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/89d72d4125e94aa3c2140fedd97ce07ba9e37674", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.666Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26856", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-01T19:36:26.233327Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:24.047Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "net: sparx5: Fix use after free inside sparx5_del_mact_entry", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerability is driven by Ethernet frames on the L2 segment \u2014 an unauthenticated attacker connected to a Sparx5 switch port populates the MAC table with chosen source MACs, and a MAC roam or FDB age-out makes the bridge emit SWITCHDEV_FDB_DEL_TO_DEVICE into sparx5_del_mact_entry(). No routing is involved, so this is same-broadcast-domain (Adjacent) rather than Network.\nAC:L - The free-then-use is unconditional straight-line code, not a race \u2014 every matching entry deletion frees mact_entry and then reads mact_entry->vid. The attacker controls both the MAC/VID that populates the table and the trigger (moving the same source MAC between ports forces br_fdb_update() to emit the delete notification synchronously), so it is reproducible on demand.\nPR:N - The frame-driven path requires no credentials or account on the switch whatsoever \u2014 MAC learning, roaming, and FDB aging are automatic. The privileged `bridge fdb del` route is only an alternative, strictly weaker trigger.\nUI:N - No victim action is needed; bridge MAC learning, roaming and aging happen automatically in response to attacker-sent frames on an already-configured bridged switch port.\nS:U - The freed object and the corrupted state are both kernel-resident within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - Freed slab memory is read back and acted upon, and the object lives in a general kmalloc cache that concurrent GFP_ATOMIC softirq allocations (including the driver's own attacker-driven switchdev work and skb allocations) can immediately reoccupy, letting an attacker influence and infer freed heap contents. Per use-after-free scoring, UAF primitives generalize to kernel memory disclosure.\nI:H - The stale value read from freed memory is written directly into the hardware MAC-table unlearn command, so the wrong VID is unlearned \u2014 the attacker's revoked MAC stays programmed and forwarded in hardware while an unrelated victim's entry can be purged, corrupting switch forwarding and isolation state. As a use-after-free it also carries the general potential for heap-grooming-based write primitives.\nA:H - Dereferencing freed slab memory can oops outright \u2014 the kfree() immediately preceding the read can discard the last-in-use slab page back to the page allocator \u2014 and KASAN/hardened kernels report or panic on it. The attacker can retrigger it continuously by flooding frames with rotating source MACs, and corrupted MAC-table state causes persistent forwarding breakage."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "lessThan": "e46274df1100fb0c06704195bfff5bfbd418bf64", "versionType": "git"}, {"status": "affected", "version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "lessThan": "0de693d68b0a18d5e256556c7c62d92cca35ad52", "versionType": "git"}, {"status": "affected", "version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "lessThan": "e83bebb718fd1f42549358730e1206164e0861d6", "versionType": "git"}, {"status": "affected", "version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "lessThan": "71809805b95052ff551922f11660008fb3666025", "versionType": "git"}, {"status": "affected", "version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "lessThan": "89d72d4125e94aa3c2140fedd97ce07ba9e37674", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"status": "unaffected", "version": "0", "lessThan": "5.14", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.152", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.82", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.22", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.10", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/e46274df1100fb0c06704195bfff5bfbd418bf64"}, {"url": "https://git.kernel.org/stable/c/0de693d68b0a18d5e256556c7c62d92cca35ad52"}, {"url": "https://git.kernel.org/stable/c/e83bebb718fd1f42549358730e1206164e0861d6"}, {"url": "https://git.kernel.org/stable/c/71809805b95052ff551922f11660008fb3666025"}, {"url": "https://git.kernel.org/stable/c/89d72d4125e94aa3c2140fedd97ce07ba9e37674"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sparx5: Fix use after free inside sparx5_del_mact_entry\n\nBased on the static analyzis of the code it looks like when an entry\nfrom the MAC table was removed, the entry was still used after being\nfreed. More precise the vid of the mac_entry was used after calling\ndevm_kfree on the mac_entry.\nThe fix consists in first using the vid of the mac_entry to delete the\nentry from the HW and after that to free it."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.152", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.82", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.22", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.10", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "5.14"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:27:50.303Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26856", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:27:50.303Z", "dateReserved": "2024-02-19T14:20:24.183Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-17T10:17:18.475Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e46274df1100fb0c06704195bfff5bfbd418bf64", "status": "affected", "version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "versionType": "git"}, {"lessThan": "0de693d68b0a18d5e256556c7c62d92cca35ad52", "status": "affected", "version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "versionType": "git"}, {"lessThan": "e83bebb718fd1f42549358730e1206164e0861d6", "status": "affected", "version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "versionType": "git"}, {"lessThan": "71809805b95052ff551922f11660008fb3666025", "status": "affected", "version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "versionType": "git"}, {"lessThan": "89d72d4125e94aa3c2140fedd97ce07ba9e37674", "status": "affected", "version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"lessThan": "5.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.152", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.82", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.22", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "31916640-A446-4FEF-843D-B96BF45DF7B9", "versionEndExcluding": "5.15.152", "versionStartIncluding": "5.14", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "933AC628-7DAD-4B2D-82E3-3B7B331B1C09", "versionEndExcluding": "6.1.82", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC6FD6F8-5B16-4F53-8116-D42F4BF4FBAC", "versionEndExcluding": "6.6.22", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FB4549F9-0160-455F-8CDC-98D38AEF6D66", "versionEndExcluding": "6.7.10", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*", "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*", "matchCriteriaId": "056BD938-0A27-4569-B391-30578B309EE3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*", "matchCriteriaId": "F02056A5-B362-4370-9FF8-6F0BD384D520", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*", "matchCriteriaId": "62075ACE-B2A0-4B16-829D-B3DA5AE5CC41", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*", "matchCriteriaId": "A780F817-2A77-4130-A9B7-5C25606314E3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*", "matchCriteriaId": "AEB9199B-AB8F-4877-8964-E2BA95B5F15C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sparx5: Fix use after free inside sparx5_del_mact_entry\n\nBased on the static analyzis of the code it looks like when an entry\nfrom the MAC table was removed, the entry was still used after being\nfreed. More precise the vid of the mac_entry was used after calling\ndevm_kfree on the mac_entry.\nThe fix consists in first using the vid of the mac_entry to delete the\nentry from the HW and after that to free it."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: sparx5: corrige el use after free dentro de sparx5_del_mact_entry Seg\u00fan el an\u00e1lisis est\u00e1tico del c\u00f3digo, parece que cuando se elimin\u00f3 una entrada de la tabla MAC, la entrada todav\u00eda se us\u00f3 despu\u00e9s de ser liberado. M\u00e1s precisamente, el video de mac_entry se us\u00f3 despu\u00e9s de llamar a devm_kfree en mac_entry. La soluci\u00f3n consiste en utilizar primero el vid de mac_entry para eliminar la entrada del HW y luego liberarla."}], "id": "CVE-2024-26856", "lastModified": "2026-08-04T11:17:13.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-26856", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-05-01T19:36:26.233327Z", "version": "2.0.3"}}]}, "published": "2024-04-17T11:15:08.740", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/0de693d68b0a18d5e256556c7c62d92cca35ad52"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/71809805b95052ff551922f11660008fb3666025"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/89d72d4125e94aa3c2140fedd97ce07ba9e37674"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/e46274df1100fb0c06704195bfff5bfbd418bf64"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/e83bebb718fd1f42549358730e1206164e0861d6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/0de693d68b0a18d5e256556c7c62d92cca35ad52"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/71809805b95052ff551922f11660008fb3666025"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/89d72d4125e94aa3c2140fedd97ce07ba9e37674"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/e46274df1100fb0c06704195bfff5bfbd418bf64"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/e83bebb718fd1f42549358730e1206164e0861d6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net: sparx5: Fix use after free inside sparx5_del_mact_entry", "id": "2275740", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2275740"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: sparx5: Fix use after free inside sparx5_del_mact_entry\nBased on the static analyzis of the code it looks like when an entry\nfrom the MAC table was removed, the entry was still used after being\nfreed. More precise the vid of the mac_entry was used after calling\ndevm_kfree on the mac_entry.\nThe fix consists in first using the vid of the mac_entry to delete the\nentry from the HW and after that to free it."], "name": "CVE-2024-26856", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26856\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26856\nhttps://lore.kernel.org/linux-cve-announce/2024041724-CVE-2024-26856-3dbf@gregkh/T"], "threat_severity": "Low"}

{"created": "2025-07-12T22:44:48.730993+00:00", "updated": "2025-07-12T22:44:48.731091+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}