Security readout for executives and security teams
Plain-English summary
A Linux ATA over Ethernet driver error can release a network-device object while queued transmission work still uses it. A local, low-privileged attacker may be able to crash the system and potentially execute code. Risk is concentrated on systems where the AoE driver is present and reachable, not every Linux installation equally.
Executive priority
Prioritize as high for exposed multi-user Linux systems using AoE, especially where untrusted local users or workloads exist. For systems without the driver or a reachable local attack path, urgency may be lower after verification. Establish affected inventory promptly, then apply supported kernel updates through normal change control.
Technical view
CVE-2024-26898 is a CWE-416 use-after-free in aoecmd_cfg_pkts(). The success path prematurely calls dev_put(ifp), while later queued transmission through tx() may dereference that net_device. The upstream correction retains the reference until transmission completes. The supplied CVSS 3.1 score is 7.8: local access, low privileges, no user interaction, and potentially complete confidentiality, integrity, and availability impact.
Likely exposure
Potentially affected Linux kernels include the supplied range from 2.6.22 through listed 6.x releases. Practical exposure depends on whether the ATA over Ethernet driver is available and used. The bundle does not establish exposure for specific distributions, configurations, appliances, or cloud environments; those require vendor and system-level verification.
Exploitation context
The supplied vector describes local, low-complexity exploitation requiring low privileges and no user interaction. A successful race could cause denial of service or potentially code execution. CISA KEV status is false, and the provided sources do not establish active exploitation or public weaponization. Treat code execution as a potential outcome, not confirmed exploitation.
Researcher notes
The record says this patch addresses CVE-2023-6270, indicating overlap that vulnerability databases may represent separately; deduplicate findings carefully. The decisive lifetime error is moving dev_put() from successful packet initialization to after transmission. The bundle supplies multiple stable-branch commits but does not map each commit to every listed version or distribution package.
Mitigation direction
- Upgrade to a vendor-supported kernel containing the applicable cited stable fix.
- Prioritize multi-user or otherwise untrusted systems where the AoE driver is enabled or used.
- If immediate upgrading is impossible, consult distribution guidance for supported mitigations.
- Avoid assuming a version is safe solely from the broad version list; verify vendor backports.
Validation and detection
- Inventory running kernel versions across Linux hosts and appliances.
- Determine whether the ATA over Ethernet driver is available, loaded, or operationally required.
- Check distribution advisories and package changelogs for a backported CVE-2024-26898 fix.
- Confirm the installed kernel contains the applicable stable patch or an equivalent vendor backport.
- After remediation, verify hosts boot the updated kernel rather than retaining the vulnerable release.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2024-26898 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H15.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7HighVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ad80c34944d7175fa1f5c7a55066020002921a99CVE reference, Linux
- https://git.kernel.org/stable/c/1a54aa506b3b2f31496731039e49778f54eee881CVE reference, Linux
- https://git.kernel.org/stable/c/faf0b4c5e00bb680e8e43ac936df24d3f48c8e65CVE reference, Linux
- https://git.kernel.org/stable/c/7dd09fa80b0765ce68bfae92f4e2f395ccf0fba4CVE reference, Linux
- https://git.kernel.org/stable/c/74ca3ef68d2f449bc848c0a814cefc487bf755faCVE reference, Linux
- https://git.kernel.org/stable/c/eb48680b0255a9e8a9bdc93d6a55b11c31262e62CVE reference, Linux
- https://git.kernel.org/stable/c/079cba4f4e307c69878226fdf5228c20aa1c969cCVE reference, Linux
- https://git.kernel.org/stable/c/a16fbb80064634b254520a46395e36b87ca4731eCVE reference, Linux
- https://git.kernel.org/stable/c/f98364e926626c678fb4b9004b75cacf92ff0662CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlCVE reference, CVE · x_transferred
- https://cert-portal.siemens.com/productcert/html/ssa-398330.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.