{"id":"CVE-2024-26851","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_h323: Add protection for bmp length out of range\n\nUBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts\nthat are out of bounds …","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_h323: Add protection for bmp length out of range\n\nUBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts\nthat are out of bounds …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-787"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 2.6.17, < 4.19.310","linux_kernel >= 4.20, < 5.4.272","linux_kernel >= 5.5, < 5.10.213","linux_kernel >= 5.11, < 5.15.152","linux_kernel >= 5.16, < 6.1.82","linux_kernel >= 6.2, < 6.6.22","linux_kernel >= 6.7, < 6.7.10","linux_kernel = 6.8","debian_linux = 10.0"],"patched":["linux_kernel 6.7.10"],"published":"2024-04-17","updated":"2026-10-15","sourceUpdated":"2026-10-15T01:17:25.280","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-26851","references":[{"url":"https://git.kernel.org/stable/c/014a807f1cc9c9d5173c1cd935835553b00d211c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/39001e3c42000e7c2038717af0d33c32319ad591","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4bafcc43baf7bcf93566394dbd15726b5b456b7a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/767146637efc528b5e3d31297df115e85a2fd362","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/80ee5054435a11c87c9a4f30f1ff750080c96416","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/98db42191329c679f4ca52bec0b319689e1ad8cb","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b3c0f553820516ad4b62a9390ecd28d6f73a7b13","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ccd1108b16ab572d9bf635586b0925635dbd6bbc","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/014a807f1cc9c9d5173c1cd935835553b00d211c","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/39001e3c42000e7c2038717af0d33c32319ad591","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/4bafcc43baf7bcf93566394dbd15726b5b456b7a","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/767146637efc528b5e3d31297df115e85a2fd362","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/80ee5054435a11c87c9a4f30f1ff750080c96416","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/98db42191329c679f4ca52bec0b319689e1ad8cb","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/b3c0f553820516ad4b62a9390ecd28d6f73a7b13","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/ccd1108b16ab572d9bf635586b0925635dbd6bbc","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00741,"epssPercentile":0.54441,"ingestedAt":"2026-10-15T03:30:12.651Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2024-06-12T17:33:25.792652Z"},"slug":"CVE-2024-26851","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_h323: Add protection for bmp length out of range\n\nUBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts\nthat are out of bounds for their data type.\n\nvmlinux   get_bitmap(b=75) + 712\n<net/netfilter/nf_conntrack_h323_asn1.c:0>\nvmlinux   decode_seq(bs=0xFFFFFFD008037000, f=0xFFFFFFD008037018, level=134443100) + 1956\n<net/netfilter/nf_conntrack_h323_asn1.c:592>\nvmlinux   decode_choice(base=0xFFFFFFD0080370F0, level=23843636) + 1216\n<net/netfilter/nf_conntrack_h323_asn1.c:814>\nvmlinux   decode_seq(f=0xFFFFFFD0080371A8, level=134443500) + 812\n<net/netfilter/nf_conntrack_h323_asn1.c:576>\nvmlinux   decode_choice(base=0xFFFFFFD008037280, level=0) + 1216\n<net/netfilter/nf_conntrack_h323_asn1.c:814>\nvmlinux   DecodeRasMessage() + 304\n<net/netfilter/nf_conntrack_h323_asn1.c:833>\nvmlinux   ras_help() + 684\n<net/netfilter/nf_conntrack_h323_main.c:1728>\nvmlinux   nf_confirm() + 188\n<net/netfilter/nf_conntrack_proto.c:137>\n\nDue to abnormal data in skb->data, the extension bitmap length\nexceeds 32 when decoding ras message then uses the length to make\na shift operation. It will change into negative after several loop.\nUBSAN load could detect a negative shift as an undefined behaviour\nand reports exception.\nSo we add the protection to avoid the length exceeding 32. Or else\nit will return out of range error and stop decoding.\n\n## Affected\n\n- `linux_kernel >= 2.6.17, < 4.19.310`\n- `linux_kernel >= 4.20, < 5.4.272`\n- `linux_kernel >= 5.5, < 5.10.213`\n- `linux_kernel >= 5.11, < 5.15.152`\n- `linux_kernel >= 5.16, < 6.1.82`\n- `linux_kernel >= 6.2, < 6.6.22`\n- `linux_kernel >= 6.7, < 6.7.10`\n- `linux_kernel = 6.8`\n- `debian_linux = 10.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.7.10`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}