Security readout for executives and security teams
Plain-English summary
A Linux IPv6 tunnelling flaw can cause the kernel to process uninitialised data when handling encapsulated network traffic. The supplied CVSS score is 8.6, with availability identified as the largest potential impact. Systems using affected kernels and IPv6 tunnel processing deserve prompt review, although the sources do not establish real-world exploitation.
Executive priority
Treat this as a high-priority patch-verification issue for exposed tunnelling hosts and critical network infrastructure. The potential availability impact supports accelerated remediation, while the absence of documented exploitation makes emergency incident assumptions unwarranted. Require owners to confirm the running kernel includes a vendor-backed fix.
Technical view
The IPv6 tunnel receive function __ip6_tnl_rcv() could access an inner header before ensuring the packet data was present. This allowed uninitialised data to reach ECN decapsulation logic. The kernel fix calls pskb_inet_may_pull() first, then initializes the IPv6 header pointer because pulling data can relocate skb->head.
Likely exposure
Exposure is limited to Linux systems running an affected kernel where relevant IPv6 tunnelling traffic reaches the vulnerable receive path. The bundle identifies affected kernel history beginning with 4.7 and provides fixes across stable branches. Distribution kernels may contain backports, so version strings alone cannot reliably determine vulnerability.
Exploitation context
The supplied record is not in CISA KEV, and no cited source establishes active exploitation. Discovery came from syzbot/KMSAN testing. The network CVSS vector indicates potentially remote reachability without privileges or user interaction, but practical exploitability and dependable impact are not demonstrated in the bundle.
Researcher notes
The failure was observed as an uninitialised-value read in ECN decapsulation through ip6ip6_dscp_ecn_decapsulate() and __ip6_tnl_rcv(). Upstream corrections ensure sufficient inner-header data is pulled before dereference and avoid retaining a stale ipv6h pointer after skb head relocation. The bundle does not identify a CWE, public proof of concept, or confirmed attack outcome.
Mitigation direction
- Install the Linux kernel update supplied by your distribution or appliance vendor.
- Confirm the installed update incorporates the applicable upstream stable fix commit.
- Prioritize internet-facing systems and infrastructure processing IPv6 tunnel traffic.
- If updates are delayed, consult vendor guidance for supported exposure-reduction measures.
Validation and detection
- Inventory kernel versions on Linux hosts, appliances, containers' hosts, and network infrastructure.
- Check distribution advisories for backported fixes rather than relying only on version numbers.
- Confirm the running kernel, not merely the installed package, contains the correction.
- Review whether IPv6 tunnel interfaces or relevant encapsulation paths are enabled and reachable.
- Monitor kernel logs for unusual tunnel-processing faults or crashes without treating absence as proof of safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-26641 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H3.94.7LinuxVulnerability scoring details
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a9bc32879a08f23cdb80a48c738017e39aea1080CVE reference, Linux
- https://git.kernel.org/stable/c/af6b5c50d47ab43e5272ad61935d0ed2e264d3f0CVE reference, Linux
- https://git.kernel.org/stable/c/d54e4da98bbfa8c257bdca94c49652d81d18a4d8CVE reference, Linux
- https://git.kernel.org/stable/c/350a6640fac4b53564ec20aa3f4a0922cb0ba5e6CVE reference, Linux
- https://git.kernel.org/stable/c/c835df3bcc14858ae9b27315dd7de76370b94f3aCVE reference, Linux
- https://git.kernel.org/stable/c/8d975c15c0cd744000ca386247432d57b21f9df0CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
- https://security.netapp.com/advisory/ntap-20241108-0008/CVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.