Security readout for executives and security teams
Plain-English summary
A flaw in Linux WireGuard management can make the kernel read already-freed peer data when configuration is displayed while peers are removed. This may crash or corrupt the kernel. The supplied rating assumes a local, low-privilege attacker and potentially severe impact, so affected WireGuard systems warrant prompt updates. The bundle provides no evidence of attacks in the wild.
Executive priority
Treat this as a prompt remediation item for WireGuard-enabled servers, gateways, appliances, and shared Linux environments. It is not supported as an emergency internet-wide threat because the vector is local and active exploitation is unconfirmed. Accelerate patching where untrusted or lower-privileged users can influence WireGuard management operations.
Technical view
A resumed WireGuard netlink dump can retain a cursor to a peer removed by wg_peer_remove_all(). That peer resides on a temporary list whose head was stack-backed; subsequent iteration may access freed peers, producing a slab use-after-free. The kernel fix checks peer->is_dead under the device update lock instead of treating an empty list as the dangling-peer signal.
Likely exposure
Potential exposure is limited to Linux systems running vulnerable kernels where WireGuard peer removal can overlap a resumed netlink configuration dump. The flattened version list does not provide reliable range semantics, so exact affected boundaries cannot be determined from this bundle alone. Map installed kernels to vendor advisories or the referenced stable fixes.
Exploitation context
The bundle marks KEV false and supplies no evidence of active exploitation. It documents reproducibility under KASAN, but does not establish reliable privilege escalation, code execution, or real-world compromise. The supplied CVSS vector characterizes exploitation as local, low-complexity, low-privilege, and requiring no user interaction.
Researcher notes
The demonstrated failure is a slab use-after-free reached through stale netlink dump cursor state after bulk peer removal. KASAN observed the invalid read during locking activity. The sources do not establish exploitability beyond the memory-safety failure. Review branch-specific stable commits because the supplied affected-version representation is insufficient for precise boundary analysis.
Mitigation direction
- Apply a vendor-supported kernel update containing the referenced WireGuard fix.
- Prioritize systems actively using WireGuard or allowing users to manage its configuration.
- If updating is delayed, consult vendor guidance and tightly restrict WireGuard configuration access.
Validation and detection
- Inventory kernel versions and identify systems where WireGuard is loaded or configured.
- Map each installed vendor kernel to a referenced upstream fix or vendor advisory.
- Confirm patched systems can dump WireGuard configuration during authorized peer changes without kernel errors.
- Review kernel logs for crashes or use-after-free reports involving WireGuard netlink operations.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-26951 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f52be46e3e6ecefc2539119784324f0cbc09620aCVE reference, Linux
- https://git.kernel.org/stable/c/710a177f347282eea162aec8712beb1f42d5ad87CVE reference, Linux
- https://git.kernel.org/stable/c/b7cea3a9af0853fdbb1b16633a458f991dde6aacCVE reference, Linux
- https://git.kernel.org/stable/c/13d107794304306164481d31ce33f8fdb25a9c04CVE reference, Linux
- https://git.kernel.org/stable/c/7bedfe4cfa38771840a355970e4437cd52d4046bCVE reference, Linux
- https://git.kernel.org/stable/c/302b2dfc013baca3dea7ceda383930d9297d231dCVE reference, Linux
- https://git.kernel.org/stable/c/55b6c738673871c9b0edae05d0c97995c1ff08c4CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.