Security readout for executives and security teams
Plain-English summary
A Linux kernel flaw in IPv4 tunnel packet handling can cause uninitialized memory to influence processing when an inner packet header is not fully available. The supplied CVSS score is 7.3, with potential limited confidentiality, integrity, and availability impact. Internet-wide exposure is not established; systems receiving tunnel traffic are the most relevant.
Executive priority
Treat this as a high-priority kernel maintenance issue for tunnel gateways and exposed infrastructure. Schedule prompt, controlled updates after confirming vendor applicability. Broader fleets can follow risk-based patching because active exploitation is not evidenced, but ambiguity in downstream backports makes inventory and vendor verification important.
Technical view
CVE-2024-26882 affects ip_tunnel_rcv(). The function could use an invalidated network-header position after pskb_inet_may_pull() reorganized packet data, leading ECN decapsulation to read uninitialized values. The fix saves and recomputes the header position after ensuring required inner headers are linearized. Syzbot detected the defect with KMSAN.
Likely exposure
Linux systems processing IPv4 tunnel traffic, including the GRE path shown in the report, warrant review. The source lists affected kernel branches from 3.10 through 6.9, but its version metadata is ambiguous and distributions may backport fixes. Confirm exposure against the running vendor kernel package, not version numbers alone.
Exploitation context
The CVSS vector describes network-reachable, low-complexity, unauthenticated exploitation without user interaction. However, the bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. The demonstrated evidence is a syzbot-generated KMSAN finding, so practical exploitability and reliable impact remain incompletely documented.
Researcher notes
CWE-457 and the KMSAN trace support an uninitialized-value issue in ECN decapsulation reached through GRE receive processing. The supplied CVSS predicts low impact across confidentiality, integrity, and availability, but the source does not demonstrate data disclosure, code execution, or reliable denial of service. Analyze downstream patches and configurations before asserting exploitability.
Mitigation direction
- Apply a vendor-supported kernel update containing the ip_tunnel_rcv() fix.
- Check distribution or appliance advisories for backported fixes before relying on version comparisons.
- Prioritize tunnel endpoints and systems exposed to untrusted GRE or IPv4 tunnel traffic.
- Where immediate patching is impossible, follow vendor guidance for supported temporary mitigations.
Validation and detection
- Inventory running kernel builds on hosts and appliances that process tunnel traffic.
- Match each build against vendor advisories, package changelogs, or the referenced stable fixes.
- Verify the installed kernel contains the ip_tunnel_rcv() header-recalculation change.
- Review kernel diagnostics for related uninitialized-value reports, crashes, or anomalous tunnel processing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-457: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-26882 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L3.93.4LinuxVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ec6bb01e02cbd47781dd90775b631a1dc4bd9d2bCVE reference, Linux
- https://git.kernel.org/stable/c/77fd5294ea09b21f6772ac954a121b87323cec80CVE reference, Linux
- https://git.kernel.org/stable/c/5c03387021cfa3336b97e0dcba38029917a8af2aCVE reference, Linux
- https://git.kernel.org/stable/c/60044ab84836359534bd7153b92e9c1584140e4aCVE reference, Linux
- https://git.kernel.org/stable/c/c4c857723b37c20651300b3de4ff25059848b4b0CVE reference, Linux
- https://git.kernel.org/stable/c/f6723d8dbfdc10c784a56748f86a9a3cd410dbd5CVE reference, Linux
- https://git.kernel.org/stable/c/ca914f1cdee8a85799942c9b0ce5015bbd6844e1CVE reference, Linux
- https://git.kernel.org/stable/c/b0ec2abf98267f14d032102551581c833b0659d3CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
- https://security.netapp.com/advisory/ntap-20241220-0002/CVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.