LiveActive security incident?Get immediate response
CVE Record

CVE-2024-26849: netlink: add nla be16/32 types to minlen array

In the Linux kernel, the following vulnerability has been resolved: netlink: add nla be16/32 types to minlen array BUG: KMSAN: uninit-value in nla_validate_range_unsigned lib/nlattr.c:222 [inline] BUG: KMSAN: uninit-value in nla_validate_int_range lib/nlattr.c:336 [inline] BUG: KMSAN: uninit-value in validate_nla lib/nlattr.c:575 [inline] BUG: KMSAN: uninit-value in __nla_validate_parse+0x2e20/0x45c0 lib/nlattr.c:631 nla_validate_range_unsigned lib/nlattr.c:222 [inline] nla_validate_int_range lib/nlattr.c:336 [inline] validate_nla lib/nlattr.c:575 [inline] ... The message in question matches this policy: [NFTA_TARGET_REV] = NLA_POLICY_MAX(NLA_BE32, 255), but because NLA_BE32 size in minlen array is 0, the validation code will read past the malformed (too small) attribute. Note: Other attributes, e.g. BITFIELD32, SINT, UINT.. are also missing: those likely should be added too.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2024-26849 is a Linux kernel netlink validation flaw. A malformed, too-small attribute can make kernel validation read beyond the provided data. The public record shows it was fixed in stable kernel commits, but does not provide CVSS, business impact, or confirmed exploitation details.

Executive priority

Treat this as a kernel maintenance issue with uncertain exploitability. Patch through normal vulnerability management, faster for multi-tenant infrastructure or systems where untrusted local workloads can reach kernel netlink interfaces.

Technical view

The bug is in Linux kernel netlink attribute validation. NLA_BE16 and NLA_BE32 were missing from the minlen array, leaving NLA_BE32 with size 0. A policy such as NLA_POLICY_MAX(NLA_BE32, 255) could therefore validate a malformed short attribute and read past it during range validation.

Likely exposure

Exposure is limited to systems running affected Linux kernel versions or downstream kernels carrying the vulnerable code. The bundle names Linux kernel 6.1 and related stable ranges, but distribution-specific package status is not included.

Exploitation context

The source bundle marks KEV as false and provides no evidence of active exploitation or public exploit use. Reachability, required privileges, and practical impact are not fully established in the provided sources.

Researcher notes

The record identifies a bounds-validation issue found by KMSAN in lib/nlattr.c. The example policy references NFTA_TARGET_REV with NLA_BE32. Other missing minlen entries are noted, but the bundle does not prove broader affected behavior or exploitability.

Mitigation direction

  • Update to a vendor kernel containing the referenced stable fixes.
  • Check your Linux distribution advisory for exact fixed package versions.
  • Prioritize internet-facing and multi-tenant Linux systems for kernel review.
  • Avoid assuming mitigation controls unless confirmed by vendor guidance.

Validation and detection

  • Inventory Linux kernel versions across servers, containers hosts, and appliances.
  • Compare running kernels against distribution advisories for CVE-2024-26849.
  • Confirm whether referenced stable commits are present in custom kernels.
  • Track remediation through reboot completion, not package installation alone.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-26849 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
7Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux24ea1c8abaae6541ad95912422a9af4fb858428d, cbfac0add2afe8960a09806012313765a2179423, ecaf75ffd5f5db320d8b1da0198eef5a5ce64a3f, ecaf75ffd5f5db320d8b1da0198eef5a5ce64a3f, ecaf75ffd5f5db320d8b1da0198eef5a5ce64a3f, ecaf75ffd5f5db320d8b1da0198eef5a5ce64a3funaffected
LinuxLinux6.1, 0, 6.1.81, 6.6.21, 6.7.9, 6.8affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.