Skip to main content

Over 150 LLM Providers · Over 5,300 Models The most extensible AI-powered pentesting platform. Open source. Star on GitHub

CVE-2024-26665

9.1 · CRITICAL
Published Apr 2, 2024 linux CWE-125 EPSS 0.68% (50th pctl)

Overview

CVE-2024-26665 is a critical-severity vulnerability affecting linux linux_kernel. It was published on April 2, 2024 and has a CVSS 3.1 base score of 9.1 (CRITICAL).

This vulnerability has a CVSS 3.1 base score of 9.1, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tunnels: fix out of bounds access when building IPv6 PMTU error

If the ICMPv6 error is built from a non-linear skb we get the following

splat,

BUG: KASAN: slab-out-of-bounds in do_csum+0x220/0x240

Read of size 4 at addr ffff88811d402c80 by task netperf/820

CPU: 0 PID: 820 Comm: netperf Not tainted 6.8.0-rc1+ #543

...

kasan_report+0xd8/0x110

do_csum+0x220/0x240

csum_partial+0xc/0x20

skb_tunnel_check_pmtu+0xeb9/0x3280

vxlan_xmit_one+0x14c2/0x4080

vxlan_xmit+0xf61/0x5c00

dev_hard_start_xmit+0xfb/0x510

__dev_queue_xmit+0x7cd/0x32a0

br_dev_queue_push_xmit+0x39d/0x6a0

Use skb_checksum instead of csum_partial who cannot deal with non-linear

SKBs.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor Product Versions Status
linux linux_kernel >= 5.9, < 5.10.210 Affected

References

Ref git.kernel.org/stable/c/510c869ffa4068c5f19ff4df51d1e2f3a30aaac1 Ref git.kernel.org/stable/c/7dc9feb8b1705cf00de20563b6bc4831f4c99dab Ref git.kernel.org/stable/c/d75abeec401f8c86b470e7028a13fcdc87e5dd06 Ref git.kernel.org/stable/c/d964dd1bc1452594b4207d9229c157d9386e5d8a Ref git.kernel.org/stable/c/e37cde7a5716466ff2a76f7f27f0a29b05b9a732 Ref git.kernel.org/stable/c/e77bf828f1ca1c47fcff58bdc26b60a9d3dfbe1d Ref git.kernel.org/stable/c/510c869ffa4068c5f19ff4df51d1e2f3a30aaac1 Ref git.kernel.org/stable/c/7dc9feb8b1705cf00de20563b6bc4831f4c99dab Ref git.kernel.org/stable/c/d75abeec401f8c86b470e7028a13fcdc87e5dd06 Ref git.kernel.org/stable/c/d964dd1bc1452594b4207d9229c157d9386e5d8a

Frequently Asked Questions

What is CVE-2024-26665?

CVE-2024-26665 is a critical-severity vulnerability affecting linux linux_kernel. It was published on April 2, 2024 and has a CVSS 3.1 base score of 9.1 (CRITICAL).

How severe is CVE-2024-26665?

This vulnerability has a CVSS 3.1 base score of 9.1, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

How do I fix or remediate CVE-2024-26665?

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2024-26665?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-26665 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.
Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.
Code Review

AI-driven PR review catches vulnerable dependencies before they ship.
HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related CRITICAL CVEs from 2024

View all →
10.0
CVE-2023-48419

An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in Elevati

10.0
CVE-2023-6339

Google Nest WiFi Pro root code-execution & user-data compromise

10.0
CVE-2023-48418

In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a     possible way to access adb

10.0
CVE-2022-46839

Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk – Best He

10.0
CVE-2024-22216

In default installations of Microchip maxView Storage Manager (for Adaptec Smart Storage Controllers

10.0
CVE-2024-21650

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of

10.0
CVE-2023-52218

Deserialization of Untrusted Data vulnerability in Anton Bond Woocommerce Tranzila Payment Gateway.T

10.0
CVE-2023-52225

Deserialization of Untrusted Data vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widge

10.0
CVE-2023-51438

A vulnerability has been identified in SIMATIC IPC1047E (All versions with maxView Storage Manager <

10.0
CVE-2023-7028

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2

10.0
CVE-2021-4434

The Social Warfare plugin for WordPress is vulnerable to Remote Code Execution in versions up to, an

10.0
CVE-2024-0643

Unrestricted upload of dangerous file types in the C21 Live Encoder and Live Mosaic product, version

Browse by year 2026 2025 2024 2023 2022 2021 2020 2019 2018 2017 2016 2015 2014 2013 2012 2011 2010 2009 2008 2007 2006 2005 2004 2003 2002 2001 2000 1999