{"id":"CVE-2024-26961","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: fix llsec key resources release in mac802154_llsec_key_del\n\nmac802154_llsec_key_del() can free resources of a key directly without\nfollowing the RCU rules fo…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: fix llsec key resources release in mac802154_llsec_key_del\n\nmac802154_llsec_key_del() can free resources of a key directly without\nfollowing the RCU rules fo…","severity":"high","cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416","CWE-459"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 3.16, < 5.10.215","linux_kernel >= 5.11, < 5.15.154","linux_kernel >= 5.16, < 6.1.84","linux_kernel >= 6.2, < 6.6.24","linux_kernel >= 6.7, < 6.7.12","linux_kernel >= 6.8, < 6.8.3"],"patched":["linux_kernel 6.8.3"],"published":"2024-05-01","updated":"2026-10-15","sourceUpdated":"2026-10-15T01:17:34.500","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-26961","references":[{"url":"https://git.kernel.org/stable/c/068ab2759bc0b4daf0b964de61b2731449c86531","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/20d3e1c8a1847497269f04d874b2a5818ec29e2d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/49c8951680d7b76fceaee89dcfbab1363fb24fd1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/640297c3e897bd7e1481466a6a5cb9560f1edb88","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d3d858650933d44ac12c1f31337e7110c2071821","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dcd51ab42b7a0431575689c5f74b8b6efd45fc2f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e8a1e58345cf40b7b272e08ac7b32328b2543e40","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/068ab2759bc0b4daf0b964de61b2731449c86531","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/20d3e1c8a1847497269f04d874b2a5818ec29e2d","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/49c8951680d7b76fceaee89dcfbab1363fb24fd1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/640297c3e897bd7e1481466a6a5cb9560f1edb88","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/d3d858650933d44ac12c1f31337e7110c2071821","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/dcd51ab42b7a0431575689c5f74b8b6efd45fc2f","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/e8a1e58345cf40b7b272e08ac7b32328b2543e40","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26961.json"},{"url":"https://access.redhat.com/security/cve/CVE-2024-26961"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278176"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-26961"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26961"},{"url":"https://lore.kernel.org/linux-cve-announce/2024050129-CVE-2024-26961-408d@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2024:8613"},{"url":"https://access.redhat.com/errata/RHSA-2024:8617"},{"url":"https://access.redhat.com/errata/RHSA-2024:5101"},{"url":"https://access.redhat.com/errata/RHSA-2024:5065"},{"url":"https://access.redhat.com/errata/RHSA-2024:10262"},{"url":"https://access.redhat.com/errata/RHSA-2024:5102"},{"url":"https://access.redhat.com/errata/RHSA-2024:8614"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00242,"epssPercentile":0.15286,"ingestedAt":"2026-10-15T03:30:12.665Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-05-28T17:51:17.536237Z"},"scores":{"nvd":7,"vendor":5.5},"slug":"CVE-2024-26961","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: fix llsec key resources release in mac802154_llsec_key_del\n\nmac802154_llsec_key_del() can free resources of a key directly without\nfollowing the RCU rules for waiting before the end of a grace period. This\nmay lead to use-after-free in case llsec_lookup_key() is traversing the\nlist of keys in parallel with a key deletion:\n\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 4 PID: 16000 at lib/refcount.c:25 refcount_warn_saturate+0x162/0x2a0\nModules linked in:\nCPU: 4 PID: 16000 Comm: wpan-ping Not tainted 6.7.0 #19\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\nRIP: 0010:refcount_warn_saturate+0x162/0x2a0\nCall Trace:\n <TASK>\n llsec_lookup_key.isra.0+0x890/0x9e0\n mac802154_llsec_encrypt+0x30c/0x9c0\n ieee802154_subif_start_xmit+0x24/0x1e0\n dev_hard_start_xmit+0x13e/0x690\n sch_direct_xmit+0x2ae/0xbc0\n __dev_queue_xmit+0x11dd/0x3c20\n dgram_sendmsg+0x90b/0xd60\n __sys_sendto+0x466/0x4c0\n __x64_sys_sendto+0xe0/0x1c0\n do_syscall_64+0x45/0xf0\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\n\nAlso, ieee802154_llsec_key_entry structures are not freed by\nmac802154_llsec_key_del():\n\nunreferenced object 0xffff8880613b6980 (size 64):\n  comm \"iwpan\", pid 2176, jiffies 4294761134 (age 60.475s)\n  hex dump (first 32 bytes):\n    78 0d 8f 18 80 88 ff ff 22 01 00 00 00 00 ad de  x.......\".......\n    00 00 00 00 00 00 00 00 03 00 cd ab 00 00 00 00  ................\n  backtrace:\n    [<ffffffff81dcfa62>] __kmem_cache_alloc_node+0x1e2/0x2d0\n    [<ffffffff81c43865>] kmalloc_trace+0x25/0xc0\n    [<ffffffff88968b09>] mac802154_llsec_key_add+0xac9/0xcf0\n    [<ffffffff8896e41a>] ieee802154_add_llsec_key+0x5a/0x80\n    [<ffffffff8892adc6>] nl802154_add_llsec_key+0x426/0x5b0\n    [<ffffffff86ff293e>] genl_family_rcv_msg_doit+0x1fe/0x2f0\n    [<ffffffff86ff46d1>] genl_rcv_msg+0x531/0x7d0\n    [<ffffffff86fee7a9>] netlink_rcv_skb+0x169/0x440\n    [<ffffffff86ff1d88>] genl_rcv+0x28/0x40\n    [<ffffffff86fec15c>] netlink_unicast+0x53c/0x820\n    [<ffffffff86fecd8b>] netlink_sendmsg+0x93b/0xe60\n    [<ffffffff86b91b35>] ____sys_sendmsg+0xac5/0xca0\n    [<ffffffff86b9c3dd>] ___sys_sendmsg+0x11d/0x1c0\n    [<ffffffff86b9c65a>] __sys_sendmsg+0xfa/0x1d0\n    [<ffffffff88eadbf5>] do_syscall_64+0x45/0xf0\n    [<ffffffff890000ea>] entry_SYSCALL_64_after_hwframe+0x6e/0x76\n\nHandle the proper resource release in the RCU callback function\nmac802154_llsec_key_del_rcu().\n\nNote that if llsec_lookup_key() finds a key, it gets a refcount via\nllsec_key_get() and locally copies key id from key_entry (which is a\nlist element). So it's safe to call llsec_key_put() and free the list\nentry after the RCU grace period elapses.\n\nFound by Linux Verification Center (linuxtesting.org).\n\n## Affected\n\n- `linux_kernel >= 3.16, < 5.10.215`\n- `linux_kernel >= 5.11, < 5.15.154`\n- `linux_kernel >= 5.16, < 6.1.84`\n- `linux_kernel >= 6.2, < 6.6.24`\n- `linux_kernel >= 6.7, < 6.7.12`\n- `linux_kernel >= 6.8, < 6.8.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.8.3`\n\n## Vendor advisories\n\n- **RHSA-2024:8613** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.2), Red Hat Enterprise Linux BaseOS EUS (v.9.2), Red Hat CodeReady Linux Builder EUS (v.9.2) · released 2024-10-30 · [advisory](https://access.redhat.com/errata/RHSA-2024:8613)\n- **RHSA-2024:8617** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CRB (v. 9), Red Hat Enterprise Linux NFV (v. 9), Red Hat Enterprise Linux RT (v. 9) · released 2024-10-30 · [advisory](https://access.redhat.com/errata/RHSA-2024:8617)\n- **RHSA-2024:5101** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2024-08-08 · [advisory](https://access.redhat.com/errata/RHSA-2024:5101)\n- **RHSA-2024:5065** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS E4S (v.8.6), Red Hat Enterprise Linux BaseOS TUS (v.8.6) · released 2024-08-07 · [advisory](https://access.redhat.com/errata/RHSA-2024:5065)\n- **RHSA-2024:10262** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS EUS (v.8.8), Red Hat CodeReady Linux Builder EUS (v.8.8) · released 2024-11-26 · [advisory](https://access.redhat.com/errata/RHSA-2024:10262)\n- **RHSA-2024:5102** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2024-08-08 · [advisory](https://access.redhat.com/errata/RHSA-2024:5102)\n- **RHSA-2024:8614** · Red Hat · fixed in: Red Hat Enterprise Linux Real Time for NFV EUS (v.9.2), Red Hat Enterprise Linux Real Time EUS (v.9.2) · released 2024-10-30 · [advisory](https://access.redhat.com/errata/RHSA-2024:8614)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26961.json)","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":38.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}