CVE-2024-26953

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-26953", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.200Z", "datePublished": "2024-05-01T05:18:43.199Z", "dateUpdated": "2026-10-30T12:18:04.284Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:18:04.284Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: esp: fix bad handling of pages from page_pool\n\nWhen the skb is reorganized during esp_output (!esp->inline), the pages\ncoming from the original skb fragments are supposed to be released back\nto the system through put_page. But if the skb fragment pages are\noriginating from a page_pool, calling put_page on them will trigger a\npage_pool leak which will eventually result in a crash.\n\nThis leak can be easily observed when using CONFIG_DEBUG_VM and doing\nipsec + gre (non offloaded) forwarding:\n\n BUG: Bad page state in process ksoftirqd/16 pfn:1451b6\n page:00000000de2b8d32 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1451b6000 pfn:0x1451b6\n flags: 0x200000000000000(node=0|zone=2)\n page_type: 0xffffffff()\n raw: 0200000000000000 dead000000000040 ffff88810d23c000 0000000000000000\n raw: 00000001451b6000 0000000000000001 00000000ffffffff 0000000000000000\n page dumped because: page_pool leak\n Modules linked in: ip_gre gre mlx5_ib mlx5_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core overlay zram zsmalloc fuse [last unloaded: mlx5_core]\n CPU: 16 PID: 96 Comm: ksoftirqd/16 Not tainted 6.8.0-rc4+ #22\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n Call Trace:\n <TASK>\n dump_stack_lvl+0x36/0x50\n bad_page+0x70/0xf0\n free_unref_page_prepare+0x27a/0x460\n free_unref_page+0x38/0x120\n esp_ssg_unref.isra.0+0x15f/0x200\n esp_output_tail+0x66d/0x780\n esp_xmit+0x2c5/0x360\n validate_xmit_xfrm+0x313/0x370\n ? validate_xmit_skb+0x1d/0x330\n validate_xmit_skb_list+0x4c/0x70\n sch_direct_xmit+0x23e/0x350\n __dev_queue_xmit+0x337/0xba0\n ? nf_hook_slow+0x3f/0xd0\n ip_finish_output2+0x25e/0x580\n iptunnel_xmit+0x19b/0x240\n ip_tunnel_xmit+0x5fb/0xb60\n ipgre_xmit+0x14d/0x280 [ip_gre]\n dev_hard_start_xmit+0xc3/0x1c0\n __dev_queue_xmit+0x208/0xba0\n ? nf_hook_slow+0x3f/0xd0\n ip_finish_output2+0x1ca/0x580\n ip_sublist_rcv_finish+0x32/0x40\n ip_sublist_rcv+0x1b2/0x1f0\n ? ip_rcv_finish_core.constprop.0+0x460/0x460\n ip_list_rcv+0x103/0x130\n __netif_receive_skb_list_core+0x181/0x1e0\n netif_receive_skb_list_internal+0x1b3/0x2c0\n napi_gro_receive+0xc8/0x200\n gro_cell_poll+0x52/0x90\n __napi_poll+0x25/0x1a0\n net_rx_action+0x28e/0x300\n __do_softirq+0xc3/0x276\n ? sort_range+0x20/0x20\n run_ksoftirqd+0x1e/0x30\n smpboot_thread_fn+0xa6/0x130\n kthread+0xcd/0x100\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x31/0x50\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork_asm+0x11/0x20\n </TASK>\n\nThe suggested fix is to introduce a new wrapper (skb_page_unref) that\ncovers page refcounting for page_pool pages as well."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable path is reached purely by received network packets \u2014 a page_pool-backed NIC RX skb forwarded into an IPsec ESP SA (`ip_list_rcv \u2192 ipgre_xmit \u2192 esp_xmit \u2192 esp_output_tail \u2192 esp_ssg_unref`), exactly as in the reported repro. No local access or syscall is involved.\nAC:L - The attacker simply sends traffic through an IPsec gateway; packet size and fragment layout (which drive the non-inplace ESP reorganization path) are attacker-controlled and the trigger repeats on every matching packet. There is no race to win and no memory-layout precondition outside the attacker's influence.\nPR:N - No authentication or credentials of any kind are needed \u2014 any unauthenticated remote host whose packets are routed into the ESP transform on the forwarding gateway reaches the bug. The vulnerable code runs in softirq on the transmit path with no privilege gate.\nUI:N - Triggering requires only that the attacker's packets be forwarded through the IPsec/GRE path; no action by any local user or administrator is needed beyond the pre-existing VPN configuration.\nS:U - The premature page free and the resulting corruption are both contained within the kernel's own security authority, with no crossing into a hypervisor or other authority.\nC:H - The page is returned to the buddy allocator while page_pool still owns it and it remains DMA-mapped, so it can be reallocated to arbitrary kernel users while still reachable as an RX buffer \u2014 a page use-after-free permitting cross-allocation disclosure of kernel memory into network-visible buffers.\nI:H - The same premature free gives a write primitive: the NIC can DMA attacker-controlled packet payload into pages that have been reallocated to other kernel objects, and the residual pp_ref_count/pool tracking leads to refcount underflow and double free \u2014 memory corruption exploitable for control-flow hijacking.\nA:H - The commit explicitly states the page_pool leak \"will eventually result in a crash\", with a confirmed `BUG: Bad page state` splat in softirq context; a remote attacker can drive this repeatedly to panic an IPsec gateway."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/skbuff.h", "net/ipv4/esp4.c", "net/ipv6/esp6.c"], "versions": [{"version": "6a5bcd84e886a9a91982e515c539529c28acdcc2", "lessThan": "21b989b62456a0e1eae9f464a5ca360a608625d1", "status": "affected", "versionType": "git"}, {"version": "6a5bcd84e886a9a91982e515c539529c28acdcc2", "lessThan": "8291b4eac429c480386669444c6377573f5d8664", "status": "affected", "versionType": "git"}, {"version": "6a5bcd84e886a9a91982e515c539529c28acdcc2", "lessThan": "1abb20a5f4b02fb3020f88456fc1e6069b3cdc45", "status": "affected", "versionType": "git"}, {"version": "6a5bcd84e886a9a91982e515c539529c28acdcc2", "lessThan": "f278ff9db67264715d0d50e3e75044f8b78990f4", "status": "affected", "versionType": "git"}, {"version": "6a5bcd84e886a9a91982e515c539529c28acdcc2", "lessThan": "c3198822c6cb9fb588e446540485669cc81c5d34", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/skbuff.h", "net/ipv4/esp4.c", "net/ipv6/esp6.c"], "versions": [{"version": "5.14", "status": "affected"}, {"version": "0", "lessThan": "5.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.24", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.12", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.3", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.6.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.7.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.8.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/21b989b62456a0e1eae9f464a5ca360a608625d1"}, {"url": "https://git.kernel.org/stable/c/8291b4eac429c480386669444c6377573f5d8664"}, {"url": "https://git.kernel.org/stable/c/1abb20a5f4b02fb3020f88456fc1e6069b3cdc45"}, {"url": "https://git.kernel.org/stable/c/f278ff9db67264715d0d50e3e75044f8b78990f4"}, {"url": "https://git.kernel.org/stable/c/c3198822c6cb9fb588e446540485669cc81c5d34"}], "title": "net: esp: fix bad handling of pages from page_pool", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.778Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/8291b4eac429c480386669444c6377573f5d8664", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1abb20a5f4b02fb3020f88456fc1e6069b3cdc45", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f278ff9db67264715d0d50e3e75044f8b78990f4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c3198822c6cb9fb588e446540485669cc81c5d34", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26953", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:45:33.246768Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:48.971Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/8291b4eac429c480386669444c6377573f5d8664", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1abb20a5f4b02fb3020f88456fc1e6069b3cdc45", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f278ff9db67264715d0d50e3e75044f8b78990f4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c3198822c6cb9fb588e446540485669cc81c5d34", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.778Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26953", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:45:33.246768Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:18.901Z"}}], "cna": {"title": "net: esp: fix bad handling of pages from page_pool", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable path is reached purely by received network packets \u2014 a page_pool-backed NIC RX skb forwarded into an IPsec ESP SA (`ip_list_rcv \u2192 ipgre_xmit \u2192 esp_xmit \u2192 esp_output_tail \u2192 esp_ssg_unref`), exactly as in the reported repro. No local access or syscall is involved.\nAC:L - The attacker simply sends traffic through an IPsec gateway; packet size and fragment layout (which drive the non-inplace ESP reorganization path) are attacker-controlled and the trigger repeats on every matching packet. There is no race to win and no memory-layout precondition outside the attacker's influence.\nPR:N - No authentication or credentials of any kind are needed \u2014 any unauthenticated remote host whose packets are routed into the ESP transform on the forwarding gateway reaches the bug. The vulnerable code runs in softirq on the transmit path with no privilege gate.\nUI:N - Triggering requires only that the attacker's packets be forwarded through the IPsec/GRE path; no action by any local user or administrator is needed beyond the pre-existing VPN configuration.\nS:U - The premature page free and the resulting corruption are both contained within the kernel's own security authority, with no crossing into a hypervisor or other authority.\nC:H - The page is returned to the buddy allocator while page_pool still owns it and it remains DMA-mapped, so it can be reallocated to arbitrary kernel users while still reachable as an RX buffer \u2014 a page use-after-free permitting cross-allocation disclosure of kernel memory into network-visible buffers.\nI:H - The same premature free gives a write primitive: the NIC can DMA attacker-controlled packet payload into pages that have been reallocated to other kernel objects, and the residual pp_ref_count/pool tracking leads to refcount underflow and double free \u2014 memory corruption exploitable for control-flow hijacking.\nA:H - The commit explicitly states the page_pool leak \"will eventually result in a crash\", with a confirmed `BUG: Bad page state` splat in softirq context; a remote attacker can drive this repeatedly to panic an IPsec gateway."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6a5bcd84e886a9a91982e515c539529c28acdcc2", "lessThan": "21b989b62456a0e1eae9f464a5ca360a608625d1", "versionType": "git"}, {"status": "affected", "version": "6a5bcd84e886a9a91982e515c539529c28acdcc2", "lessThan": "8291b4eac429c480386669444c6377573f5d8664", "versionType": "git"}, {"status": "affected", "version": "6a5bcd84e886a9a91982e515c539529c28acdcc2", "lessThan": "1abb20a5f4b02fb3020f88456fc1e6069b3cdc45", "versionType": "git"}, {"status": "affected", "version": "6a5bcd84e886a9a91982e515c539529c28acdcc2", "lessThan": "f278ff9db67264715d0d50e3e75044f8b78990f4", "versionType": "git"}, {"status": "affected", "version": "6a5bcd84e886a9a91982e515c539529c28acdcc2", "lessThan": "c3198822c6cb9fb588e446540485669cc81c5d34", "versionType": "git"}], "programFiles": ["include/linux/skbuff.h", "net/ipv4/esp4.c", "net/ipv6/esp6.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"status": "unaffected", "version": "0", "lessThan": "5.14", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.24", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.12", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8.3", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/linux/skbuff.h", "net/ipv4/esp4.c", "net/ipv6/esp6.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/21b989b62456a0e1eae9f464a5ca360a608625d1"}, {"url": "https://git.kernel.org/stable/c/8291b4eac429c480386669444c6377573f5d8664"}, {"url": "https://git.kernel.org/stable/c/1abb20a5f4b02fb3020f88456fc1e6069b3cdc45"}, {"url": "https://git.kernel.org/stable/c/f278ff9db67264715d0d50e3e75044f8b78990f4"}, {"url": "https://git.kernel.org/stable/c/c3198822c6cb9fb588e446540485669cc81c5d34"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: esp: fix bad handling of pages from page_pool\n\nWhen the skb is reorganized during esp_output (!esp->inline), the pages\ncoming from the original skb fragments are supposed to be released back\nto the system through put_page. But if the skb fragment pages are\noriginating from a page_pool, calling put_page on them will trigger a\npage_pool leak which will eventually result in a crash.\n\nThis leak can be easily observed when using CONFIG_DEBUG_VM and doing\nipsec + gre (non offloaded) forwarding:\n\n BUG: Bad page state in process ksoftirqd/16 pfn:1451b6\n page:00000000de2b8d32 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1451b6000 pfn:0x1451b6\n flags: 0x200000000000000(node=0|zone=2)\n page_type: 0xffffffff()\n raw: 0200000000000000 dead000000000040 ffff88810d23c000 0000000000000000\n raw: 00000001451b6000 0000000000000001 00000000ffffffff 0000000000000000\n page dumped because: page_pool leak\n Modules linked in: ip_gre gre mlx5_ib mlx5_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core overlay zram zsmalloc fuse [last unloaded: mlx5_core]\n CPU: 16 PID: 96 Comm: ksoftirqd/16 Not tainted 6.8.0-rc4+ #22\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n Call Trace:\n <TASK>\n dump_stack_lvl+0x36/0x50\n bad_page+0x70/0xf0\n free_unref_page_prepare+0x27a/0x460\n free_unref_page+0x38/0x120\n esp_ssg_unref.isra.0+0x15f/0x200\n esp_output_tail+0x66d/0x780\n esp_xmit+0x2c5/0x360\n validate_xmit_xfrm+0x313/0x370\n ? validate_xmit_skb+0x1d/0x330\n validate_xmit_skb_list+0x4c/0x70\n sch_direct_xmit+0x23e/0x350\n __dev_queue_xmit+0x337/0xba0\n ? nf_hook_slow+0x3f/0xd0\n ip_finish_output2+0x25e/0x580\n iptunnel_xmit+0x19b/0x240\n ip_tunnel_xmit+0x5fb/0xb60\n ipgre_xmit+0x14d/0x280 [ip_gre]\n dev_hard_start_xmit+0xc3/0x1c0\n __dev_queue_xmit+0x208/0xba0\n ? nf_hook_slow+0x3f/0xd0\n ip_finish_output2+0x1ca/0x580\n ip_sublist_rcv_finish+0x32/0x40\n ip_sublist_rcv+0x1b2/0x1f0\n ? ip_rcv_finish_core.constprop.0+0x460/0x460\n ip_list_rcv+0x103/0x130\n __netif_receive_skb_list_core+0x181/0x1e0\n netif_receive_skb_list_internal+0x1b3/0x2c0\n napi_gro_receive+0xc8/0x200\n gro_cell_poll+0x52/0x90\n __napi_poll+0x25/0x1a0\n net_rx_action+0x28e/0x300\n __do_softirq+0xc3/0x276\n ? sort_range+0x20/0x20\n run_ksoftirqd+0x1e/0x30\n smpboot_thread_fn+0xa6/0x130\n kthread+0xcd/0x100\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x31/0x50\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork_asm+0x11/0x20\n </TASK>\n\nThe suggested fix is to introduce a new wrapper (skb_page_unref) that\ncovers page refcounting for page_pool pages as well."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.191", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.24", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.12", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.3", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "5.14"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:18:04.284Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26953", "state": "PUBLISHED", "dateUpdated": "2026-10-30T12:18:04.284Z", "dateReserved": "2024-02-19T14:20:24.200Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-01T05:18:43.199Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/linux/skbuff.h", "net/ipv4/esp4.c", "net/ipv6/esp6.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "21b989b62456a0e1eae9f464a5ca360a608625d1", "status": "affected", "version": "6a5bcd84e886a9a91982e515c539529c28acdcc2", "versionType": "git"}, {"lessThan": "8291b4eac429c480386669444c6377573f5d8664", "status": "affected", "version": "6a5bcd84e886a9a91982e515c539529c28acdcc2", "versionType": "git"}, {"lessThan": "1abb20a5f4b02fb3020f88456fc1e6069b3cdc45", "status": "affected", "version": "6a5bcd84e886a9a91982e515c539529c28acdcc2", "versionType": "git"}, {"lessThan": "f278ff9db67264715d0d50e3e75044f8b78990f4", "status": "affected", "version": "6a5bcd84e886a9a91982e515c539529c28acdcc2", "versionType": "git"}, {"lessThan": "c3198822c6cb9fb588e446540485669cc81c5d34", "status": "affected", "version": "6a5bcd84e886a9a91982e515c539529c28acdcc2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/linux/skbuff.h", "net/ipv4/esp4.c", "net/ipv6/esp6.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"lessThan": "5.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.24", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.12", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "756F1E77-6E83-4610-9310-8DF006943A8E", "versionEndExcluding": "6.6.24", "versionStartIncluding": "5.14", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6BE9771A-BAFD-4624-95F9-58D536540C53", "versionEndExcluding": "6.7.12", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C59BBC3-6495-4A77-9C82-55EC7CDF5E02", "versionEndExcluding": "6.8.3", "versionStartIncluding": "6.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: esp: fix bad handling of pages from page_pool\n\nWhen the skb is reorganized during esp_output (!esp->inline), the pages\ncoming from the original skb fragments are supposed to be released back\nto the system through put_page. But if the skb fragment pages are\noriginating from a page_pool, calling put_page on them will trigger a\npage_pool leak which will eventually result in a crash.\n\nThis leak can be easily observed when using CONFIG_DEBUG_VM and doing\nipsec + gre (non offloaded) forwarding:\n\n BUG: Bad page state in process ksoftirqd/16 pfn:1451b6\n page:00000000de2b8d32 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1451b6000 pfn:0x1451b6\n flags: 0x200000000000000(node=0|zone=2)\n page_type: 0xffffffff()\n raw: 0200000000000000 dead000000000040 ffff88810d23c000 0000000000000000\n raw: 00000001451b6000 0000000000000001 00000000ffffffff 0000000000000000\n page dumped because: page_pool leak\n Modules linked in: ip_gre gre mlx5_ib mlx5_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core overlay zram zsmalloc fuse [last unloaded: mlx5_core]\n CPU: 16 PID: 96 Comm: ksoftirqd/16 Not tainted 6.8.0-rc4+ #22\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n Call Trace:\n <TASK>\n dump_stack_lvl+0x36/0x50\n bad_page+0x70/0xf0\n free_unref_page_prepare+0x27a/0x460\n free_unref_page+0x38/0x120\n esp_ssg_unref.isra.0+0x15f/0x200\n esp_output_tail+0x66d/0x780\n esp_xmit+0x2c5/0x360\n validate_xmit_xfrm+0x313/0x370\n ? validate_xmit_skb+0x1d/0x330\n validate_xmit_skb_list+0x4c/0x70\n sch_direct_xmit+0x23e/0x350\n __dev_queue_xmit+0x337/0xba0\n ? nf_hook_slow+0x3f/0xd0\n ip_finish_output2+0x25e/0x580\n iptunnel_xmit+0x19b/0x240\n ip_tunnel_xmit+0x5fb/0xb60\n ipgre_xmit+0x14d/0x280 [ip_gre]\n dev_hard_start_xmit+0xc3/0x1c0\n __dev_queue_xmit+0x208/0xba0\n ? nf_hook_slow+0x3f/0xd0\n ip_finish_output2+0x1ca/0x580\n ip_sublist_rcv_finish+0x32/0x40\n ip_sublist_rcv+0x1b2/0x1f0\n ? ip_rcv_finish_core.constprop.0+0x460/0x460\n ip_list_rcv+0x103/0x130\n __netif_receive_skb_list_core+0x181/0x1e0\n netif_receive_skb_list_internal+0x1b3/0x2c0\n napi_gro_receive+0xc8/0x200\n gro_cell_poll+0x52/0x90\n __napi_poll+0x25/0x1a0\n net_rx_action+0x28e/0x300\n __do_softirq+0xc3/0x276\n ? sort_range+0x20/0x20\n run_ksoftirqd+0x1e/0x30\n smpboot_thread_fn+0xa6/0x130\n kthread+0xcd/0x100\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x31/0x50\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork_asm+0x11/0x20\n </TASK>\n\nThe suggested fix is to introduce a new wrapper (skb_page_unref) that\ncovers page refcounting for page_pool pages as well."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: esp: corrige el mal manejo de las p\u00e1ginas desde page_pool Cuando el skb se reorganiza durante esp_output (!esp-&gt;inline), se supone que las p\u00e1ginas provenientes de los fragmentos del skb original son devuelto al sistema a trav\u00e9s de put_page. Pero si las p\u00e1ginas del fragmento skb se originan en un page_pool, llamar a put_page en ellas desencadenar\u00e1 una fuga de page_pool que eventualmente resultar\u00e1 en un bloqueo. Esta fuga se puede observar f\u00e1cilmente cuando se usa CONFIG_DEBUG_VM y se realiza el reenv\u00edo ipsec + gre (no descargado): ERROR: Estado de p\u00e1gina incorrecto en el proceso ksoftirqd/16 pfn:1451b6 p\u00e1gina:00000000de2b8d32 refcount:0 mapcount:0 mapeo:0000000000000000 \u00edndice:0x1451b6000 pfn: 0x1451b6 banderas: 0x200000000000000(nodo=0|zona=2) tipo de p\u00e1gina: 0xffffffff() sin formato: 0200000000000000 muerto000000000040 ffff88810d23c000 0000000000000000 sin formato: 0001451b6000 0000000000000001 00000000ffffffff 0000000000000000 p\u00e1gina volcada porque: fuga de page_pool M\u00f3dulos vinculados en: ip_gre gre mlx5_ib mlx5_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core overlay zram zsmalloc fuse [\u00faltima descarga: mlx5_core] CPU: 16 PID: 96 Comm: ksoftirqd/16 No contaminado 6 .8.0-rc4+ #22 Nombre del hardware: PC est\u00e1ndar QEMU (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 01/04/2014 Seguimiento de llamadas: dump_stack_lvl+0x36/0x50 bad_page+0x70/0xf0 free_unref_page_prepare+0x27a/0x460 free_unref_page+0x38/0x120 esp_ssg_unref.isra.0+0x15f/0x200 esp_output_tail+0x66d/0x780 esp_xmit+0x2c5/0x360 validar_xmit_xfrm+0x313/0x370 ? validar_xmit_skb+0x1d/0x330 validar_xmit_skb_list+0x4c/0x70 sch_direct_xmit+0x23e/0x350 __dev_queue_xmit+0x337/0xba0 ? nf_hook_slow+0x3f/0xd0 ip_finish_output2+0x25e/0x580 iptunnel_xmit+0x19b/0x240 ip_tunnel_xmit+0x5fb/0xb60 ipgre_xmit+0x14d/0x280 [ip_gre] dev_hard_start_xmit+0xc3/0x1c0 __dev_queue_xmit+0x208/0xba0? nf_hook_slow+0x3f/0xd0 ip_finish_output2+0x1ca/0x580 ip_sublist_rcv_finish+0x32/0x40 ip_sublist_rcv+0x1b2/0x1f0 ? ip_rcv_finish_core.constprop.0+0x460/0x460 ip_list_rcv+0x103/0x130 __netif_receive_skb_list_core+0x181/0x1e0 netif_receive_skb_list_internal+0x1b3/0x2c0 napi_gro_receive+0xc8/0x200 encuesta+0x52/0x90 __napi_poll+0x25/0x1a0 net_rx_action+0x28e/0x300 __do_softirq+0xc3/0x276 ? sort_range+0x20/0x20 run_ksoftirqd+0x1e/0x30 smpboot_thread_fn+0xa6/0x130 kthread+0xcd/0x100 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x31/0x50 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork_asm+0x11/0x20 La soluci\u00f3n sugerida es introducir un nuevo contenedor (skb_page_unref) que cubra tambi\u00e9n el recuento de p\u00e1ginas para las p\u00e1ginas page_pool."}], "id": "CVE-2024-26953", "lastModified": "2026-10-30T13:17:24.180", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-26953", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:45:33.246768Z", "version": "2.0.3"}}]}, "published": "2024-05-01T06:15:11.457", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1abb20a5f4b02fb3020f88456fc1e6069b3cdc45"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/21b989b62456a0e1eae9f464a5ca360a608625d1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8291b4eac429c480386669444c6377573f5d8664"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c3198822c6cb9fb588e446540485669cc81c5d34"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f278ff9db67264715d0d50e3e75044f8b78990f4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1abb20a5f4b02fb3020f88456fc1e6069b3cdc45"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8291b4eac429c480386669444c6377573f5d8664"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c3198822c6cb9fb588e446540485669cc81c5d34"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f278ff9db67264715d0d50e3e75044f8b78990f4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:9315", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}], "bugzilla": {"description": "kernel: net: esp: fix bad handling of pages from page_pool", "id": "2278193", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2278193"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: esp: fix bad handling of pages from page_pool\nWhen the skb is reorganized during esp_output (!esp->inline), the pages\ncoming from the original skb fragments are supposed to be released back\nto the system through put_page. But if the skb fragment pages are\noriginating from a page_pool, calling put_page on them will trigger a\npage_pool leak which will eventually result in a crash.\nThis leak can be easily observed when using CONFIG_DEBUG_VM and doing\nipsec + gre (non offloaded) forwarding:\nBUG: Bad page state in process ksoftirqd/16 pfn:1451b6\npage:00000000de2b8d32 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1451b6000 pfn:0x1451b6\nflags: 0x200000000000000(node=0|zone=2)\npage_type: 0xffffffff()\nraw: 0200000000000000 dead000000000040 ffff88810d23c000 0000000000000000\nraw: 00000001451b6000 0000000000000001 00000000ffffffff 0000000000000000\npage dumped because: page_pool leak\nModules linked in: ip_gre gre mlx5_ib mlx5_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core overlay zram zsmalloc fuse [last unloaded: mlx5_core]\nCPU: 16 PID: 96 Comm: ksoftirqd/16 Not tainted 6.8.0-rc4+ #22\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nCall Trace:\n<TASK>\ndump_stack_lvl+0x36/0x50\nbad_page+0x70/0xf0\nfree_unref_page_prepare+0x27a/0x460\nfree_unref_page+0x38/0x120\nesp_ssg_unref.isra.0+0x15f/0x200\nesp_output_tail+0x66d/0x780\nesp_xmit+0x2c5/0x360\nvalidate_xmit_xfrm+0x313/0x370\n? validate_xmit_skb+0x1d/0x330\nvalidate_xmit_skb_list+0x4c/0x70\nsch_direct_xmit+0x23e/0x350\n__dev_queue_xmit+0x337/0xba0\n? nf_hook_slow+0x3f/0xd0\nip_finish_output2+0x25e/0x580\niptunnel_xmit+0x19b/0x240\nip_tunnel_xmit+0x5fb/0xb60\nipgre_xmit+0x14d/0x280 [ip_gre]\ndev_hard_start_xmit+0xc3/0x1c0\n__dev_queue_xmit+0x208/0xba0\n? nf_hook_slow+0x3f/0xd0\nip_finish_output2+0x1ca/0x580\nip_sublist_rcv_finish+0x32/0x40\nip_sublist_rcv+0x1b2/0x1f0\n? ip_rcv_finish_core.constprop.0+0x460/0x460\nip_list_rcv+0x103/0x130\n__netif_receive_skb_list_core+0x181/0x1e0\nnetif_receive_skb_list_internal+0x1b3/0x2c0\nnapi_gro_receive+0xc8/0x200\ngro_cell_poll+0x52/0x90\n__napi_poll+0x25/0x1a0\nnet_rx_action+0x28e/0x300\n__do_softirq+0xc3/0x276\n? sort_range+0x20/0x20\nrun_ksoftirqd+0x1e/0x30\nsmpboot_thread_fn+0xa6/0x130\nkthread+0xcd/0x100\n? kthread_complete_and_exit+0x20/0x20\nret_from_fork+0x31/0x50\n? kthread_complete_and_exit+0x20/0x20\nret_from_fork_asm+0x11/0x20\n</TASK>\nThe suggested fix is to introduce a new wrapper (skb_page_unref) that\ncovers page refcounting for page_pool pages as well."], "name": "CVE-2024-26953", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26953\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26953\nhttps://lore.kernel.org/linux-cve-announce/2024050128-CVE-2024-26953-8304@gregkh/T"], "threat_severity": "Low"}

{}