CVE-2024-26669 (GCVE-0-2024-26669)

Vulnerability from cvelistv5 – Published: 2024-04-02 06:43 – Updated: 2025-05-04 08:53
VLAI?
Title
net/sched: flower: Fix chain template offload
Summary
In the Linux kernel, the following vulnerability has been resolved: net/sched: flower: Fix chain template offload When a qdisc is deleted from a net device the stack instructs the underlying driver to remove its flow offload callback from the associated filter block using the 'FLOW_BLOCK_UNBIND' command. The stack then continues to replay the removal of the filters in the block for this driver by iterating over the chains in the block and invoking the 'reoffload' operation of the classifier being used. In turn, the classifier in its 'reoffload' operation prepares and emits a 'FLOW_CLS_DESTROY' command for each filter. However, the stack does not do the same for chain templates and the underlying driver never receives a 'FLOW_CLS_TMPLT_DESTROY' command when a qdisc is deleted. This results in a memory leak [1] which can be reproduced using [2]. Fix by introducing a 'tmplt_reoffload' operation and have the stack invoke it with the appropriate arguments as part of the replay. Implement the operation in the sole classifier that supports chain templates (flower) by emitting the 'FLOW_CLS_TMPLT_{CREATE,DESTROY}' command based on whether a flow offload callback is being bound to a filter block or being unbound from one. As far as I can tell, the issue happens since cited commit which reordered tcf_block_offload_unbind() before tcf_block_flush_all_chains() in __tcf_block_put(). The order cannot be reversed as the filter block is expected to be freed after flushing all the chains. [1] unreferenced object 0xffff888107e28800 (size 2048): comm "tc", pid 1079, jiffies 4294958525 (age 3074.287s) hex dump (first 32 bytes): b1 a6 7c 11 81 88 ff ff e0 5b b3 10 81 88 ff ff ..|......[...... 01 00 00 00 00 00 00 00 e0 aa b0 84 ff ff ff ff ................ backtrace: [<ffffffff81c06a68>] __kmem_cache_alloc_node+0x1e8/0x320 [<ffffffff81ab374e>] __kmalloc+0x4e/0x90 [<ffffffff832aec6d>] mlxsw_sp_acl_ruleset_get+0x34d/0x7a0 [<ffffffff832bc195>] mlxsw_sp_flower_tmplt_create+0x145/0x180 [<ffffffff832b2e1a>] mlxsw_sp_flow_block_cb+0x1ea/0x280 [<ffffffff83a10613>] tc_setup_cb_call+0x183/0x340 [<ffffffff83a9f85a>] fl_tmplt_create+0x3da/0x4c0 [<ffffffff83a22435>] tc_ctl_chain+0xa15/0x1170 [<ffffffff838a863c>] rtnetlink_rcv_msg+0x3cc/0xed0 [<ffffffff83ac87f0>] netlink_rcv_skb+0x170/0x440 [<ffffffff83ac6270>] netlink_unicast+0x540/0x820 [<ffffffff83ac6e28>] netlink_sendmsg+0x8d8/0xda0 [<ffffffff83793def>] ____sys_sendmsg+0x30f/0xa80 [<ffffffff8379d29a>] ___sys_sendmsg+0x13a/0x1e0 [<ffffffff8379d50c>] __sys_sendmsg+0x11c/0x1f0 [<ffffffff843b9ce0>] do_syscall_64+0x40/0xe0 unreferenced object 0xffff88816d2c0400 (size 1024): comm "tc", pid 1079, jiffies 4294958525 (age 3074.287s) hex dump (first 32 bytes): 40 00 00 00 00 00 00 00 57 f6 38 be 00 00 00 00 @.......W.8..... 10 04 2c 6d 81 88 ff ff 10 04 2c 6d 81 88 ff ff ..,m......,m.... backtrace: [<ffffffff81c06a68>] __kmem_cache_alloc_node+0x1e8/0x320 [<ffffffff81ab36c1>] __kmalloc_node+0x51/0x90 [<ffffffff81a8ed96>] kvmalloc_node+0xa6/0x1f0 [<ffffffff82827d03>] bucket_table_alloc.isra.0+0x83/0x460 [<ffffffff82828d2b>] rhashtable_init+0x43b/0x7c0 [<ffffffff832aed48>] mlxsw_sp_acl_ruleset_get+0x428/0x7a0 [<ffffffff832bc195>] mlxsw_sp_flower_tmplt_create+0x145/0x180 [<ffffffff832b2e1a>] mlxsw_sp_flow_block_cb+0x1ea/0x280 [<ffffffff83a10613>] tc_setup_cb_call+0x183/0x340 [<ffffffff83a9f85a>] fl_tmplt_create+0x3da/0x4c0 [<ffffffff83a22435>] tc_ctl_chain+0xa15/0x1170 [<ffffffff838a863c>] rtnetlink_rcv_msg+0x3cc/0xed0 [<ffffffff83ac87f0>] netlink_rcv_skb+0x170/0x440 [<ffffffff83ac6270>] netlink_unicast+0x540/0x820 [<ffffffff83ac6e28>] netlink_sendmsg+0x8d8/0xda0 [<ffffffff83793def>] ____sys_sendmsg+0x30f/0xa80 [2] # tc qdisc add dev swp1 clsact # tc chain add dev swp1 ingress proto ip chain 1 flower dst_ip 0.0.0.0/32 # tc qdisc del dev ---truncated---
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: bbf73830cd48cff1599811d4f69c7cfd49c7b869 , < 9ed46144cff3598a5cf79955630e795ff9af5b97 (git)
Affected: bbf73830cd48cff1599811d4f69c7cfd49c7b869 , < c04709b2cc99ae31c346f79f0211752d7b74df01 (git)
Affected: bbf73830cd48cff1599811d4f69c7cfd49c7b869 , < 32f2a0afa95fae0d1ceec2ff06e0e816939964b8 (git)
Create a notification for this product.
    Linux Linux Affected: 5.1
Unaffected: 0 , < 5.1 (semver)
Unaffected: 6.6.15 , ≤ 6.6.* (semver)
Unaffected: 6.7.3 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26669",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-02T18:36:26.875588Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-04T17:38:55.453Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:12.714Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9ed46144cff3598a5cf79955630e795ff9af5b97"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c04709b2cc99ae31c346f79f0211752d7b74df01"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/32f2a0afa95fae0d1ceec2ff06e0e816939964b8"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/sch_generic.h",
            "net/sched/cls_api.c",
            "net/sched/cls_flower.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9ed46144cff3598a5cf79955630e795ff9af5b97",
              "status": "affected",
              "version": "bbf73830cd48cff1599811d4f69c7cfd49c7b869",
              "versionType": "git"
            },
            {
              "lessThan": "c04709b2cc99ae31c346f79f0211752d7b74df01",
              "status": "affected",
              "version": "bbf73830cd48cff1599811d4f69c7cfd49c7b869",
              "versionType": "git"
            },
            {
              "lessThan": "32f2a0afa95fae0d1ceec2ff06e0e816939964b8",
              "status": "affected",
              "version": "bbf73830cd48cff1599811d4f69c7cfd49c7b869",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/sch_generic.h",
            "net/sched/cls_api.c",
            "net/sched/cls_flower.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.15",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.3",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: flower: Fix chain template offload\n\nWhen a qdisc is deleted from a net device the stack instructs the\nunderlying driver to remove its flow offload callback from the\nassociated filter block using the \u0027FLOW_BLOCK_UNBIND\u0027 command. The stack\nthen continues to replay the removal of the filters in the block for\nthis driver by iterating over the chains in the block and invoking the\n\u0027reoffload\u0027 operation of the classifier being used. In turn, the\nclassifier in its \u0027reoffload\u0027 operation prepares and emits a\n\u0027FLOW_CLS_DESTROY\u0027 command for each filter.\n\nHowever, the stack does not do the same for chain templates and the\nunderlying driver never receives a \u0027FLOW_CLS_TMPLT_DESTROY\u0027 command when\na qdisc is deleted. This results in a memory leak [1] which can be\nreproduced using [2].\n\nFix by introducing a \u0027tmplt_reoffload\u0027 operation and have the stack\ninvoke it with the appropriate arguments as part of the replay.\nImplement the operation in the sole classifier that supports chain\ntemplates (flower) by emitting the \u0027FLOW_CLS_TMPLT_{CREATE,DESTROY}\u0027\ncommand based on whether a flow offload callback is being bound to a\nfilter block or being unbound from one.\n\nAs far as I can tell, the issue happens since cited commit which\nreordered tcf_block_offload_unbind() before tcf_block_flush_all_chains()\nin __tcf_block_put(). The order cannot be reversed as the filter block\nis expected to be freed after flushing all the chains.\n\n[1]\nunreferenced object 0xffff888107e28800 (size 2048):\n  comm \"tc\", pid 1079, jiffies 4294958525 (age 3074.287s)\n  hex dump (first 32 bytes):\n    b1 a6 7c 11 81 88 ff ff e0 5b b3 10 81 88 ff ff  ..|......[......\n    01 00 00 00 00 00 00 00 e0 aa b0 84 ff ff ff ff  ................\n  backtrace:\n    [\u003cffffffff81c06a68\u003e] __kmem_cache_alloc_node+0x1e8/0x320\n    [\u003cffffffff81ab374e\u003e] __kmalloc+0x4e/0x90\n    [\u003cffffffff832aec6d\u003e] mlxsw_sp_acl_ruleset_get+0x34d/0x7a0\n    [\u003cffffffff832bc195\u003e] mlxsw_sp_flower_tmplt_create+0x145/0x180\n    [\u003cffffffff832b2e1a\u003e] mlxsw_sp_flow_block_cb+0x1ea/0x280\n    [\u003cffffffff83a10613\u003e] tc_setup_cb_call+0x183/0x340\n    [\u003cffffffff83a9f85a\u003e] fl_tmplt_create+0x3da/0x4c0\n    [\u003cffffffff83a22435\u003e] tc_ctl_chain+0xa15/0x1170\n    [\u003cffffffff838a863c\u003e] rtnetlink_rcv_msg+0x3cc/0xed0\n    [\u003cffffffff83ac87f0\u003e] netlink_rcv_skb+0x170/0x440\n    [\u003cffffffff83ac6270\u003e] netlink_unicast+0x540/0x820\n    [\u003cffffffff83ac6e28\u003e] netlink_sendmsg+0x8d8/0xda0\n    [\u003cffffffff83793def\u003e] ____sys_sendmsg+0x30f/0xa80\n    [\u003cffffffff8379d29a\u003e] ___sys_sendmsg+0x13a/0x1e0\n    [\u003cffffffff8379d50c\u003e] __sys_sendmsg+0x11c/0x1f0\n    [\u003cffffffff843b9ce0\u003e] do_syscall_64+0x40/0xe0\nunreferenced object 0xffff88816d2c0400 (size 1024):\n  comm \"tc\", pid 1079, jiffies 4294958525 (age 3074.287s)\n  hex dump (first 32 bytes):\n    40 00 00 00 00 00 00 00 57 f6 38 be 00 00 00 00  @.......W.8.....\n    10 04 2c 6d 81 88 ff ff 10 04 2c 6d 81 88 ff ff  ..,m......,m....\n  backtrace:\n    [\u003cffffffff81c06a68\u003e] __kmem_cache_alloc_node+0x1e8/0x320\n    [\u003cffffffff81ab36c1\u003e] __kmalloc_node+0x51/0x90\n    [\u003cffffffff81a8ed96\u003e] kvmalloc_node+0xa6/0x1f0\n    [\u003cffffffff82827d03\u003e] bucket_table_alloc.isra.0+0x83/0x460\n    [\u003cffffffff82828d2b\u003e] rhashtable_init+0x43b/0x7c0\n    [\u003cffffffff832aed48\u003e] mlxsw_sp_acl_ruleset_get+0x428/0x7a0\n    [\u003cffffffff832bc195\u003e] mlxsw_sp_flower_tmplt_create+0x145/0x180\n    [\u003cffffffff832b2e1a\u003e] mlxsw_sp_flow_block_cb+0x1ea/0x280\n    [\u003cffffffff83a10613\u003e] tc_setup_cb_call+0x183/0x340\n    [\u003cffffffff83a9f85a\u003e] fl_tmplt_create+0x3da/0x4c0\n    [\u003cffffffff83a22435\u003e] tc_ctl_chain+0xa15/0x1170\n    [\u003cffffffff838a863c\u003e] rtnetlink_rcv_msg+0x3cc/0xed0\n    [\u003cffffffff83ac87f0\u003e] netlink_rcv_skb+0x170/0x440\n    [\u003cffffffff83ac6270\u003e] netlink_unicast+0x540/0x820\n    [\u003cffffffff83ac6e28\u003e] netlink_sendmsg+0x8d8/0xda0\n    [\u003cffffffff83793def\u003e] ____sys_sendmsg+0x30f/0xa80\n\n[2]\n # tc qdisc add dev swp1 clsact\n # tc chain add dev swp1 ingress proto ip chain 1 flower dst_ip 0.0.0.0/32\n # tc qdisc del dev\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:53:33.748Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9ed46144cff3598a5cf79955630e795ff9af5b97"
        },
        {
          "url": "https://git.kernel.org/stable/c/c04709b2cc99ae31c346f79f0211752d7b74df01"
        },
        {
          "url": "https://git.kernel.org/stable/c/32f2a0afa95fae0d1ceec2ff06e0e816939964b8"
        }
      ],
      "title": "net/sched: flower: Fix chain template offload",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26669",
    "datePublished": "2024-04-02T06:43:30.378Z",
    "dateReserved": "2024-02-19T14:20:24.150Z",
    "dateUpdated": "2025-05-04T08:53:33.748Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9ed46144cff3598a5cf79955630e795ff9af5b97\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c04709b2cc99ae31c346f79f0211752d7b74df01\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/32f2a0afa95fae0d1ceec2ff06e0e816939964b8\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:12.714Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26669\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-02T18:36:26.875588Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:21.323Z\"}}], \"cna\": {\"title\": \"net/sched: flower: Fix chain template offload\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"bbf73830cd48cff1599811d4f69c7cfd49c7b869\", \"lessThan\": \"9ed46144cff3598a5cf79955630e795ff9af5b97\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bbf73830cd48cff1599811d4f69c7cfd49c7b869\", \"lessThan\": \"c04709b2cc99ae31c346f79f0211752d7b74df01\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bbf73830cd48cff1599811d4f69c7cfd49c7b869\", \"lessThan\": \"32f2a0afa95fae0d1ceec2ff06e0e816939964b8\", \"versionType\": \"git\"}], \"programFiles\": [\"include/net/sch_generic.h\", \"net/sched/cls_api.c\", \"net/sched/cls_flower.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.1\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.1\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.15\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/net/sch_generic.h\", \"net/sched/cls_api.c\", \"net/sched/cls_flower.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9ed46144cff3598a5cf79955630e795ff9af5b97\"}, {\"url\": \"https://git.kernel.org/stable/c/c04709b2cc99ae31c346f79f0211752d7b74df01\"}, {\"url\": \"https://git.kernel.org/stable/c/32f2a0afa95fae0d1ceec2ff06e0e816939964b8\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/sched: flower: Fix chain template offload\\n\\nWhen a qdisc is deleted from a net device the stack instructs the\\nunderlying driver to remove its flow offload callback from the\\nassociated filter block using the \u0027FLOW_BLOCK_UNBIND\u0027 command. The stack\\nthen continues to replay the removal of the filters in the block for\\nthis driver by iterating over the chains in the block and invoking the\\n\u0027reoffload\u0027 operation of the classifier being used. In turn, the\\nclassifier in its \u0027reoffload\u0027 operation prepares and emits a\\n\u0027FLOW_CLS_DESTROY\u0027 command for each filter.\\n\\nHowever, the stack does not do the same for chain templates and the\\nunderlying driver never receives a \u0027FLOW_CLS_TMPLT_DESTROY\u0027 command when\\na qdisc is deleted. This results in a memory leak [1] which can be\\nreproduced using [2].\\n\\nFix by introducing a \u0027tmplt_reoffload\u0027 operation and have the stack\\ninvoke it with the appropriate arguments as part of the replay.\\nImplement the operation in the sole classifier that supports chain\\ntemplates (flower) by emitting the \u0027FLOW_CLS_TMPLT_{CREATE,DESTROY}\u0027\\ncommand based on whether a flow offload callback is being bound to a\\nfilter block or being unbound from one.\\n\\nAs far as I can tell, the issue happens since cited commit which\\nreordered tcf_block_offload_unbind() before tcf_block_flush_all_chains()\\nin __tcf_block_put(). The order cannot be reversed as the filter block\\nis expected to be freed after flushing all the chains.\\n\\n[1]\\nunreferenced object 0xffff888107e28800 (size 2048):\\n  comm \\\"tc\\\", pid 1079, jiffies 4294958525 (age 3074.287s)\\n  hex dump (first 32 bytes):\\n    b1 a6 7c 11 81 88 ff ff e0 5b b3 10 81 88 ff ff  ..|......[......\\n    01 00 00 00 00 00 00 00 e0 aa b0 84 ff ff ff ff  ................\\n  backtrace:\\n    [\u003cffffffff81c06a68\u003e] __kmem_cache_alloc_node+0x1e8/0x320\\n    [\u003cffffffff81ab374e\u003e] __kmalloc+0x4e/0x90\\n    [\u003cffffffff832aec6d\u003e] mlxsw_sp_acl_ruleset_get+0x34d/0x7a0\\n    [\u003cffffffff832bc195\u003e] mlxsw_sp_flower_tmplt_create+0x145/0x180\\n    [\u003cffffffff832b2e1a\u003e] mlxsw_sp_flow_block_cb+0x1ea/0x280\\n    [\u003cffffffff83a10613\u003e] tc_setup_cb_call+0x183/0x340\\n    [\u003cffffffff83a9f85a\u003e] fl_tmplt_create+0x3da/0x4c0\\n    [\u003cffffffff83a22435\u003e] tc_ctl_chain+0xa15/0x1170\\n    [\u003cffffffff838a863c\u003e] rtnetlink_rcv_msg+0x3cc/0xed0\\n    [\u003cffffffff83ac87f0\u003e] netlink_rcv_skb+0x170/0x440\\n    [\u003cffffffff83ac6270\u003e] netlink_unicast+0x540/0x820\\n    [\u003cffffffff83ac6e28\u003e] netlink_sendmsg+0x8d8/0xda0\\n    [\u003cffffffff83793def\u003e] ____sys_sendmsg+0x30f/0xa80\\n    [\u003cffffffff8379d29a\u003e] ___sys_sendmsg+0x13a/0x1e0\\n    [\u003cffffffff8379d50c\u003e] __sys_sendmsg+0x11c/0x1f0\\n    [\u003cffffffff843b9ce0\u003e] do_syscall_64+0x40/0xe0\\nunreferenced object 0xffff88816d2c0400 (size 1024):\\n  comm \\\"tc\\\", pid 1079, jiffies 4294958525 (age 3074.287s)\\n  hex dump (first 32 bytes):\\n    40 00 00 00 00 00 00 00 57 f6 38 be 00 00 00 00  @.......W.8.....\\n    10 04 2c 6d 81 88 ff ff 10 04 2c 6d 81 88 ff ff  ..,m......,m....\\n  backtrace:\\n    [\u003cffffffff81c06a68\u003e] __kmem_cache_alloc_node+0x1e8/0x320\\n    [\u003cffffffff81ab36c1\u003e] __kmalloc_node+0x51/0x90\\n    [\u003cffffffff81a8ed96\u003e] kvmalloc_node+0xa6/0x1f0\\n    [\u003cffffffff82827d03\u003e] bucket_table_alloc.isra.0+0x83/0x460\\n    [\u003cffffffff82828d2b\u003e] rhashtable_init+0x43b/0x7c0\\n    [\u003cffffffff832aed48\u003e] mlxsw_sp_acl_ruleset_get+0x428/0x7a0\\n    [\u003cffffffff832bc195\u003e] mlxsw_sp_flower_tmplt_create+0x145/0x180\\n    [\u003cffffffff832b2e1a\u003e] mlxsw_sp_flow_block_cb+0x1ea/0x280\\n    [\u003cffffffff83a10613\u003e] tc_setup_cb_call+0x183/0x340\\n    [\u003cffffffff83a9f85a\u003e] fl_tmplt_create+0x3da/0x4c0\\n    [\u003cffffffff83a22435\u003e] tc_ctl_chain+0xa15/0x1170\\n    [\u003cffffffff838a863c\u003e] rtnetlink_rcv_msg+0x3cc/0xed0\\n    [\u003cffffffff83ac87f0\u003e] netlink_rcv_skb+0x170/0x440\\n    [\u003cffffffff83ac6270\u003e] netlink_unicast+0x540/0x820\\n    [\u003cffffffff83ac6e28\u003e] netlink_sendmsg+0x8d8/0xda0\\n    [\u003cffffffff83793def\u003e] ____sys_sendmsg+0x30f/0xa80\\n\\n[2]\\n # tc qdisc add dev swp1 clsact\\n # tc chain add dev swp1 ingress proto ip chain 1 flower dst_ip 0.0.0.0/32\\n # tc qdisc del dev\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.15\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.3\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"5.1\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T08:53:33.748Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26669\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T08:53:33.748Z\", \"dateReserved\": \"2024-02-19T14:20:24.150Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-02T06:43:30.378Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.