Security readout for executives and security teams
Plain-English summary
An untrusted virtual network function can remove a MAC address that the host administrator assigned, undermining network policy and potentially disrupting connectivity. The issue affects integrity and availability, not confidentiality, and requires local low-privilege access to the virtual function.
Executive priority
Prioritize affected multi-tenant, virtualized, and network-sensitive hosts because an untrusted workload could disrupt connectivity or weaken administrator-enforced addressing. Systems without i40e SR-IOV virtual functions are unlikely to be exposed. Patch through supported vendor channels after compatibility testing.
Technical view
The Linux i40e driver incorrectly permits an untrusted SR-IOV virtual function to delete its primary, PF-administered MAC when the VF is brought down. This removes the MAC filter and resets the primary VF MAC to zero, crossing the PF/VF trust boundary.
Likely exposure
Exposure is limited to Linux systems using the i40e driver with SR-IOV virtual functions on affected kernels. Risk is greatest where tenants, guests, containers, or other untrusted workloads can control a VF whose MAC is administratively assigned by the physical function.
Exploitation context
The supplied CVSS rates exploitation as local, low complexity, low privilege, and requiring no user interaction. CISA KEV status is false, and the supplied sources provide no evidence of active exploitation. Exploitation requires control of an affected untrusted VF.
Researcher notes
The security boundary is between the privileged physical function and an untrusted virtual function. The corrected behavior prevents the VF from deleting a primary MAC established administratively by the PF. The bundle lists affected versions but does not provide complete distribution-specific package mappings; validate against vendor advisories and commit inclusion.
Mitigation direction
- Update to a vendor-supported kernel containing the referenced i40e stable fix.
- Review distribution or appliance vendor guidance for the applicable corrected kernel package.
- Restrict untrusted workload access to i40e SR-IOV virtual functions until patched.
- Monitor administratively assigned VF MAC addresses for unexpected clearing or zeroing.
Validation and detection
- Inventory systems using the i40e driver and enabled SR-IOV virtual functions.
- Identify kernel versions and compare them with vendor advisories and referenced stable fixes.
- Confirm untrusted VFs cannot remove PF-administratively assigned primary MAC addresses.
- Verify assigned VF MAC filters persist through normal VF interface state changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-26830 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H25.8LinuxVulnerability scoring details
Base CVSS 3.1 score
8.4HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1c981792e4ccbc134b468797acdd7781959e6893CVE reference, Linux
- https://git.kernel.org/stable/c/be147926140ac48022c9605d7ab0a67387e4b404CVE reference, Linux
- https://git.kernel.org/stable/c/d250a81ba813a93563be68072c563aa1e346346dCVE reference, Linux
- https://git.kernel.org/stable/c/73d9629e1c8c1982f13688c4d1019c3994647cccCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.