CVE-2024-26852

Q: What is the severity of CVE-2024-26852?

CVE-2024-26852 has a CVSS score of 7.8 (HIGH). This is a use-after-free vulnerability in the Linux kernel's IPv6 routing subsystem, specifically in the ip6_route_mpath_notify() function. Attackers could potentially exploit this to cause kernel crashes (denial of service) or execute arbitrary code with kernel privileges. Any system running an affected Linux kernel version with IPv6 enabled is vulnerable.

7.8 HIGH

Denial of Service

📋 TL;DR

This is a use-after-free vulnerability in the Linux kernel's IPv6 routing subsystem, specifically in the ip6_route_mpath_notify() function. Attackers could potentially exploit this to cause kernel crashes (denial of service) or execute arbitrary code with kernel privileges. Any system running an affected Linux kernel version with IPv6 enabled is vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE, but references indicate fixes in stable kernel trees. Likely affects multiple recent kernel versions before the fix.

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires IPv6 to be enabled and configured. Systems with IPv6 disabled are not vulnerable.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, or potential arbitrary code execution with kernel privileges resulting in complete system compromise.

🟠

Likely Case

Kernel crash leading to system instability or denial of service, requiring system reboot to recover.

🟢

If Mitigated

No impact if IPv6 is disabled or the system is patched.

🌐 Internet-Facing: MEDIUM - Requires IPv6 connectivity and ability to trigger specific routing operations, but could be exploited remotely if IPv6 routing is exposed.

🏢 Internal Only: MEDIUM - Similar risk profile as internet-facing, but requires internal network access to trigger the vulnerable code path.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH - Requires specific knowledge of kernel internals and ability to trigger the vulnerable code path through routing operations.

Discovered through syzkaller fuzzing. Exploitation requires ability to create/modify IPv6 routes, which typically requires CAP_NET_ADMIN privileges or root access.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel commits referenced: 31ea5bcc7d4cd1423de6be327a2c034725704136, 394334fe2ae3b9f1e2332b873857e84cb28aac18, 61b34f73cdbdb8eaf9ea12e9e2eb3b29716c4dda, 664f9c647260cc9d68b4e31d9899530d89dd045e, 685f7d531264599b3f167f1e94bbd22f120e5fab

Vendor Advisory: https://git.kernel.org/stable/c/31ea5bcc7d4cd1423de6be327a2c034725704136

Restart Required: Yes

Instructions:

1. Update to a kernel version containing the fix commits. 2. Check your distribution's security advisories for specific patched kernel versions. 3. Reboot the system after kernel update.

🔧 Temporary Workarounds

Disable IPv6

linux

Completely disable IPv6 to prevent exploitation of this vulnerability

echo 'net.ipv6.conf.all.disable_ipv6 = 1' >> /etc/sysctl.conf
echo 'net.ipv6.conf.default.disable_ipv6 = 1' >> /etc/sysctl.conf
sysctl -p

Restrict route modification capabilities

linux

Limit users who can modify IPv6 routing tables to reduce attack surface

Review and restrict CAP_NET_ADMIN capabilities
Use SELinux/AppArmor to restrict route modification operations

🧯 If You Can't Patch

Disable IPv6 completely if not needed
Implement strict network segmentation to limit who can trigger routing operations
Monitor for unusual route modification attempts in system logs

🔍 How to Verify

Check if Vulnerable:

Check kernel version and verify if it contains the fix commits. Vulnerable if running an affected kernel version with IPv6 enabled.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated to one containing the fix commits. Check /proc/version or uname -r and compare with patched versions from your distribution.

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
KASAN reports of use-after-free in ip6_route_mpath_notify or related functions
Unexpected system crashes or reboots

Network Indicators:

Unusual IPv6 route modification attempts
Multiple failed route addition attempts

SIEM Query:

source="kernel" AND ("KASAN" OR "use-after-free" OR "ip6_route_mpath_notify" OR "rt6_fill_node")

📊 Metadata

CVE ID: CVE-2024-26852

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: April 17, 2024

Last Updated: March 21, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable IPv6

Restrict route modification capabilities

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities