--- id: CVE-2024-26961 title: |- In the Linux kernel, the following vulnerability has been resolved: mac802154: fix llsec key resources release in mac802154_llsec_key_del mac802154_llsec_key_del() can free resources of a key directly without following the RCU rules fo… summary: |- In the Linux kernel, the following vulnerability has been resolved: mac802154: fix llsec key resources release in mac802154_llsec_key_del mac802154_llsec_key_del() can free resources of a key directly without following the RCU rules fo… severity: high cvss: 7 cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-416 - CWE-459 vendor: linux product: linux_kernel affected: - 'linux_kernel >= 3.16, < 5.10.215' - 'linux_kernel >= 5.11, < 5.15.154' - 'linux_kernel >= 5.16, < 6.1.84' - 'linux_kernel >= 6.2, < 6.6.24' - 'linux_kernel >= 6.7, < 6.7.12' - 'linux_kernel >= 6.8, < 6.8.3' patched: - linux_kernel 6.8.3 published: '2024-05-01' updated: '2026-10-15' sourceUpdated: '2026-10-15T01:17:34.500' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-26961' references: - url: 'https://git.kernel.org/stable/c/068ab2759bc0b4daf0b964de61b2731449c86531' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/20d3e1c8a1847497269f04d874b2a5818ec29e2d' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/49c8951680d7b76fceaee89dcfbab1363fb24fd1' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/640297c3e897bd7e1481466a6a5cb9560f1edb88' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/d3d858650933d44ac12c1f31337e7110c2071821' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/dcd51ab42b7a0431575689c5f74b8b6efd45fc2f' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/e8a1e58345cf40b7b272e08ac7b32328b2543e40' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/068ab2759bc0b4daf0b964de61b2731449c86531' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://git.kernel.org/stable/c/20d3e1c8a1847497269f04d874b2a5818ec29e2d' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://git.kernel.org/stable/c/49c8951680d7b76fceaee89dcfbab1363fb24fd1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://git.kernel.org/stable/c/640297c3e897bd7e1481466a6a5cb9560f1edb88' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://git.kernel.org/stable/c/d3d858650933d44ac12c1f31337e7110c2071821' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://git.kernel.org/stable/c/dcd51ab42b7a0431575689c5f74b8b6efd45fc2f' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://git.kernel.org/stable/c/e8a1e58345cf40b7b272e08ac7b32328b2543e40' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-265688.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26961.json - url: 'https://access.redhat.com/security/cve/CVE-2024-26961' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2278176' - url: 'https://www.cve.org/CVERecord?id=CVE-2024-26961' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-26961' - url: >- https://lore.kernel.org/linux-cve-announce/2024050129-CVE-2024-26961-408d@gregkh/T - url: 'https://access.redhat.com/errata/RHSA-2024:8613' - url: 'https://access.redhat.com/errata/RHSA-2024:8617' - url: 'https://access.redhat.com/errata/RHSA-2024:5101' - url: 'https://access.redhat.com/errata/RHSA-2024:5065' - url: 'https://access.redhat.com/errata/RHSA-2024:10262' - url: 'https://access.redhat.com/errata/RHSA-2024:5102' - url: 'https://access.redhat.com/errata/RHSA-2024:8614' tags: - nvd - cve.org - csaf - vex - red-hat epss: 0.00242 epssPercentile: 0.15286 ingestedAt: '2026-10-15T03:30:12.665Z' ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2024-05-28T17:51:17.536237Z' scores: nvd: 7 vendor: 5.5 --- ## Overview In the Linux kernel, the following vulnerability has been resolved: mac802154: fix llsec key resources release in mac802154_llsec_key_del mac802154_llsec_key_del() can free resources of a key directly without following the RCU rules for waiting before the end of a grace period. This may lead to use-after-free in case llsec_lookup_key() is traversing the list of keys in parallel with a key deletion: refcount_t: addition on 0; use-after-free. WARNING: CPU: 4 PID: 16000 at lib/refcount.c:25 refcount_warn_saturate+0x162/0x2a0 Modules linked in: CPU: 4 PID: 16000 Comm: wpan-ping Not tainted 6.7.0 #19 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:refcount_warn_saturate+0x162/0x2a0 Call Trace: llsec_lookup_key.isra.0+0x890/0x9e0 mac802154_llsec_encrypt+0x30c/0x9c0 ieee802154_subif_start_xmit+0x24/0x1e0 dev_hard_start_xmit+0x13e/0x690 sch_direct_xmit+0x2ae/0xbc0 __dev_queue_xmit+0x11dd/0x3c20 dgram_sendmsg+0x90b/0xd60 __sys_sendto+0x466/0x4c0 __x64_sys_sendto+0xe0/0x1c0 do_syscall_64+0x45/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 Also, ieee802154_llsec_key_entry structures are not freed by mac802154_llsec_key_del(): unreferenced object 0xffff8880613b6980 (size 64): comm "iwpan", pid 2176, jiffies 4294761134 (age 60.475s) hex dump (first 32 bytes): 78 0d 8f 18 80 88 ff ff 22 01 00 00 00 00 ad de x......."....... 00 00 00 00 00 00 00 00 03 00 cd ab 00 00 00 00 ................ backtrace: [] __kmem_cache_alloc_node+0x1e2/0x2d0 [] kmalloc_trace+0x25/0xc0 [] mac802154_llsec_key_add+0xac9/0xcf0 [] ieee802154_add_llsec_key+0x5a/0x80 [] nl802154_add_llsec_key+0x426/0x5b0 [] genl_family_rcv_msg_doit+0x1fe/0x2f0 [] genl_rcv_msg+0x531/0x7d0 [] netlink_rcv_skb+0x169/0x440 [] genl_rcv+0x28/0x40 [] netlink_unicast+0x53c/0x820 [] netlink_sendmsg+0x93b/0xe60 [] ____sys_sendmsg+0xac5/0xca0 [] ___sys_sendmsg+0x11d/0x1c0 [] __sys_sendmsg+0xfa/0x1d0 [] do_syscall_64+0x45/0xf0 [] entry_SYSCALL_64_after_hwframe+0x6e/0x76 Handle the proper resource release in the RCU callback function mac802154_llsec_key_del_rcu(). Note that if llsec_lookup_key() finds a key, it gets a refcount via llsec_key_get() and locally copies key id from key_entry (which is a list element). So it's safe to call llsec_key_put() and free the list entry after the RCU grace period elapses. Found by Linux Verification Center (linuxtesting.org). ## Affected - `linux_kernel >= 3.16, < 5.10.215` - `linux_kernel >= 5.11, < 5.15.154` - `linux_kernel >= 5.16, < 6.1.84` - `linux_kernel >= 6.2, < 6.6.24` - `linux_kernel >= 6.7, < 6.7.12` - `linux_kernel >= 6.8, < 6.8.3` ## Remediation Upgrade past the affected range: - `linux_kernel 6.8.3` ## Vendor advisories - **RHSA-2024:8613** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.2), Red Hat Enterprise Linux BaseOS EUS (v.9.2), Red Hat CodeReady Linux Builder EUS (v.9.2) · released 2024-10-30 · [advisory](https://access.redhat.com/errata/RHSA-2024:8613) - **RHSA-2024:8617** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CRB (v. 9), Red Hat Enterprise Linux NFV (v. 9), Red Hat Enterprise Linux RT (v. 9) · released 2024-10-30 · [advisory](https://access.redhat.com/errata/RHSA-2024:8617) - **RHSA-2024:5101** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2024-08-08 · [advisory](https://access.redhat.com/errata/RHSA-2024:5101) - **RHSA-2024:5065** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS E4S (v.8.6), Red Hat Enterprise Linux BaseOS TUS (v.8.6) · released 2024-08-07 · [advisory](https://access.redhat.com/errata/RHSA-2024:5065) - **RHSA-2024:10262** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS EUS (v.8.8), Red Hat CodeReady Linux Builder EUS (v.8.8) · released 2024-11-26 · [advisory](https://access.redhat.com/errata/RHSA-2024:10262) - **RHSA-2024:5102** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2024-08-08 · [advisory](https://access.redhat.com/errata/RHSA-2024:5102) - **RHSA-2024:8614** · Red Hat · fixed in: Red Hat Enterprise Linux Real Time for NFV EUS (v.9.2), Red Hat Enterprise Linux Real Time EUS (v.9.2) · released 2024-10-30 · [advisory](https://access.redhat.com/errata/RHSA-2024:8614) - **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26961.json)