CVE-2024-26849

netlink: add nla be16/32 types to minlen array

MEDIUM

5.5

CVSS Score

Published: April 17, 2024 at 10:14 AM UTC

Updated: June 17, 2026 at 07:18 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: netlink: add nla be16/32 types to minlen array BUG: KMSAN: uninit-value in nla_validate_range_unsigned lib/nlattr.c:222 [inline] BUG: KMSAN: uninit-value in nla_validate_int_range lib/nlattr.c:336 [inline] BUG: KMSAN: uninit-value in validate_nla lib/nlattr.c:575 [inline] BUG: KMSAN: uninit-value in __nla_validate_parse+0x2e20/0x45c0 lib/nlattr.c:631 nla_validate_range_unsigned lib/nlattr.c:222 [inline] nla_validate_int_range lib/nlattr.c:336 [inline] validate_nla lib/nlattr.c:575 [inline] ... The message in question matches this policy: [NFTA_TARGET_REV] = NLA_POLICY_MAX(NLA_BE32, 255), but because NLA_BE32 size in minlen array is 0, the validation code will read past the malformed (too small) attribute. Note: Other attributes, e.g. BITFIELD32, SINT, UINT.. are also missing: those likely should be added too.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

6.1 ≤ v < 6.1.816.1 ≤ v < 6.6.216.1 ≤ v < 6.7.96.1 ≤ v < 6.86.2 ≤ v < 6.6.216.7 ≤ v < 6.7.924ea1c8abaae6541ad95912422a9af4fb858428d6.8 rc1 6.8 rc2 6.8 rc3 6.8 rc4 6.8 rc5 6.8 rc6cbfac0add2afe8960a09806012313765a2179423ecaf75ffd5f5db320d8b1da0198eef5a5ce64a3f

Vendor states this is fixed in 000a68159c0326b46c42ec712ab98793e7e625a7 (fixed)

Vendor states this is fixed in 0ac219c4c3ab253f3981f346903458d20bacab32 (fixed)

Vendor states this is fixed in 7a9d14c63b35f89563c5ecbadf918ad64979712d (fixed)

Vendor states this is fixed in 80b40f9cb87f3bf5877dfb852765cf92bc03ca77 (fixed)

Vendor states this is fixed in 9a0d18853c280f6a0ee99f91619f2442a17a323a (fixed)

Vendor states this is fixed in a2ab028151841cd833cb53eb99427e0cc990112d (fixed)

Vendor states this is fixed in 6.1 (unaffected)

Vendor states this is fixed in 6.1.81 (unaffected)

Vendor states this is fixed in 6.6.21 (unaffected)

Vendor states this is fixed in 6.7.9 (unaffected)

Vendor states this is fixed in 6.8 (unaffected)