Security readout for executives and security teams
Plain-English summary
A flaw in the Linux kernel’s GTP networking subsystem can access invalid or freed memory during interface creation. A local, low-privileged attacker may be able to crash the system or potentially affect kernel confidentiality and integrity, although the supplied evidence demonstrates a Syzkaller-triggered fault rather than successful malicious exploitation.
Executive priority
Treat this as a high-priority kernel maintenance issue on shared or otherwise locally accessible Linux systems. It is less urgent for isolated systems without untrusted local users or available GTP functionality. There is no supplied evidence of active exploitation, so prioritize controlled patching and exposure verification rather than emergency incident response based on this CVE alone.
Technical view
The GTP module registered link operations before its per-network operations, creating an unsafe initialization window in gtp_newlink(). The supplied trace shows a null-pointer dereference and identifies a related use-after-free risk. CVSS 3.1 scores it 7.8 with local, low-complexity, low-privilege access and high potential impact across confidentiality, integrity, and availability.
Likely exposure
Exposure is limited to Linux systems running an affected kernel with GTP functionality available. The CVSS vector requires local low-privileged access, not remote network access. Exact vulnerable package versions vary because distributors may backport fixes; the supplied version metadata alone is insufficient for definitive fleet matching.
Exploitation context
The source bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. Syzkaller reproduced a kernel fault under testing. The sources do not establish reliable code execution, exploitation at scale, or the precise operational privileges needed beyond the CVSS low-privilege rating.
Researcher notes
The affected-version data is ambiguous and includes repeated commit identifiers, so validate fixes by distribution package and backported commit. The demonstrated condition is a protection fault with KASAN during GTP module lifecycle activity. The source attributes remediation to registering per-network operations before link operations, but the truncated description prevents deeper assessment of teardown races or exploitability.
Mitigation direction
- Install a distribution kernel update containing the applicable cited stable-kernel fix.
- Confirm the update covers your kernel branch; version numbers alone may not reveal backported fixes.
- If immediate updating is impossible, consult the Linux distributor for supported mitigations or workarounds.
- Prioritize multi-user systems where untrusted users can obtain local accounts.
Validation and detection
- Record each system’s running kernel release, package revision, and distributor.
- Compare package revisions against applicable distributor advisories and backport documentation.
- Verify the installed kernel includes the relevant cited stable commit for its branch.
- Determine whether the GTP kernel module or functionality is installed, available, or loaded.
- Review kernel logs for faults referencing gtp_newlink or gtp_genl_dump_pdp.
- After updating, reboot and confirm the patched kernel is actually running.
Public sources used
- CVE Program record for CVE-2024-26793
- CVE List V5 record
- Linux stable fix 01129059
- Linux stable fix ec92aa2c
- Linux stable fix e668b92a
- Linux stable fix 9376d059
- Linux stable fix abd32d7f
- Linux stable fix 93dd420b
- Linux stable fix 5366969a
- Linux stable fix 616d82c3
- Debian LTS announcement, June 2024
- Debian LTS announcement, June 2024
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-26793 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/01129059d5141d62fae692f7a336ae3bc712d3ebCVE reference, Linux
- https://git.kernel.org/stable/c/ec92aa2cab6f0048f10d6aa4f025c5885cb1a1b6CVE reference, Linux
- https://git.kernel.org/stable/c/e668b92a3a01429923fd5ca13e99642aab47de69CVE reference, Linux
- https://git.kernel.org/stable/c/9376d059a705c5dfaac566c2d09891242013ae16CVE reference, Linux
- https://git.kernel.org/stable/c/abd32d7f5c0294c1b2454c5a3b13b18446bac627CVE reference, Linux
- https://git.kernel.org/stable/c/93dd420bc41531c9a31498b9538ca83ba6ec191eCVE reference, Linux
- https://git.kernel.org/stable/c/5366969a19a8a0d2ffb3d27ef6e8905e5e4216f8CVE reference, Linux
- https://git.kernel.org/stable/c/616d82c3cfa2a2146dd7e3ae47bda7e877ee549eCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlCVE reference, CVE · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.