LiveActive security incident?Get immediate response
CVE Record

CVE-2024-26862: packet: annotate data-races around ignore_outgoing

In the Linux kernel, the following vulnerability has been resolved: packet: annotate data-races around ignore_outgoing ignore_outgoing is read locklessly from dev_queue_xmit_nit() and packet_getsockopt() Add appropriate READ_ONCE()/WRITE_ONCE() annotations. syzbot reported: BUG: KCSAN: data-race in dev_queue_xmit_nit / packet_setsockopt write to 0xffff888107804542 of 1 bytes by task 22618 on cpu 0: packet_setsockopt+0xd83/0xfd0 net/packet/af_packet.c:4003 do_sock_setsockopt net/socket.c:2311 [inline] __sys_setsockopt+0x1d8/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [inline] __se_sys_setsockopt net/socket.c:2340 [inline] __x64_sys_setsockopt+0x66/0x80 net/socket.c:2340 do_syscall_64+0xd3/0x1d0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 read to 0xffff888107804542 of 1 bytes by task 27 on cpu 1: dev_queue_xmit_nit+0x82/0x620 net/core/dev.c:2248 xmit_one net/core/dev.c:3527 [inline] dev_hard_start_xmit+0xcc/0x3f0 net/core/dev.c:3547 __dev_queue_xmit+0xf24/0x1dd0 net/core/dev.c:4335 dev_queue_xmit include/linux/netdevice.h:3091 [inline] batadv_send_skb_packet+0x264/0x300 net/batman-adv/send.c:108 batadv_send_broadcast_skb+0x24/0x30 net/batman-adv/send.c:127 batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:392 [inline] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline] batadv_iv_send_outstanding_bat_ogm_packet+0x3f0/0x4b0 net/batman-adv/bat_iv_ogm.c:1700 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0x465/0x990 kernel/workqueue.c:3335 worker_thread+0x526/0x730 kernel/workqueue.c:3416 kthread+0x1d1/0x210 kernel/kthread.c:388 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 value changed: 0x00 -> 0x01 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 27 Comm: kworker/u8:1 Tainted: G W 6.8.0-syzkaller-08073-g480e035fc4c7 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This CVE is a Linux kernel concurrency bug in packet socket handling. The public record shows a data race on the ignore_outgoing setting, found by syzbot/KCSAN and fixed by kernel stable commits. The sources do not provide CVSS, business impact, or evidence of exploitation.

Executive priority

Treat this as a routine kernel maintenance item unless vendor guidance raises severity. There is insufficient public evidence for emergency action, but unpatched kernel issues should be tracked because downstream impact may vary by distribution and workload.

Technical view

The race occurs when ignore_outgoing is read without locking in dev_queue_xmit_nit() and packet_getsockopt() while packet_setsockopt() writes it. The resolution adds READ_ONCE()/WRITE_ONCE() annotations in the Linux networking packet path. The observed report came from a syzkaller test kernel.

Likely exposure

Exposure is limited to Linux systems running affected kernel versions or downstream kernels missing the referenced stable fixes. The source data identifies Linux as affected but does not define affected distributions, configurations, privileges, or reachable attack paths.

Exploitation context

No active exploitation is supported by the provided sources. The CVE is not marked KEV, and the bundle describes a sanitizer-detected data race rather than a public exploit or demonstrated security impact.

Researcher notes

The available evidence is narrow: a KCSAN report and stable fixes adding access annotations. No CVSS, CWE, exploitability assessment, or privilege model is included in the source bundle. Avoid extrapolating impact beyond the documented data race.

Mitigation direction

  • Update affected Linux kernels through trusted distribution or vendor channels.
  • Confirm the update includes one of the referenced stable kernel fixes.
  • Review Debian LTS and other vendor advisories for package-specific guidance.
  • If patching is delayed, follow vendor guidance; no workaround is provided here.

Validation and detection

  • Inventory Linux kernel versions across servers, containers hosts, and appliances.
  • Compare running kernels against vendor advisories and the referenced stable commits.
  • Check whether distribution kernel packages include the fix for CVE-2024-26862.
  • Document any systems still running affected or unverified kernels.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-26862 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
10Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxfa788d986a3aac5069378ed04697bd06f83d3488, fa788d986a3aac5069378ed04697bd06f83d3488, fa788d986a3aac5069378ed04697bd06f83d3488, fa788d986a3aac5069378ed04697bd06f83d3488, fa788d986a3aac5069378ed04697bd06f83d3488, fa788d986a3aac5069378ed04697bd06f83d3488, fa788d986a3aac5069378ed04697bd06f83d3488, fa788d986a3aac5069378ed04697bd06f83d3488unaffected
LinuxLinux4.20, 0, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.