Security readout for executives and security teams
Plain-English summary
A Linux networking flaw can mishandle packet memory during certain non-offloaded IPsec and GRE forwarding. Pages may not return correctly to their memory pool, eventually producing a bad page state and crashing the system. The primary demonstrated business impact is loss of availability on affected network infrastructure.
Executive priority
Treat this as urgent for network gateways matching the documented traffic path because a crash could interrupt critical connectivity. Do not assume every Linux server is equally exposed. Prioritize asset identification, vendor package verification, controlled updates, and post-update monitoring.
Technical view
During non-inline ESP output, skb reorganization releases original fragment pages using ordinary page reference handling. For fragments originating from page_pool, this causes a page_pool leak and eventual kernel crash. The documented correction introduces skb_page_unref so page_pool-backed fragments receive appropriate reference handling.
Likely exposure
Exposure is most plausible on affected Linux kernels performing non-offloaded IPsec plus GRE forwarding where skb fragment pages originate from page_pool. Systems not using this packet-processing path may be less exposed. The supplied version information lacks clear range semantics, so downstream kernel packages and backports require individual verification.
Exploitation context
The supplied record is not in CISA KEV and provides no evidence of active exploitation. Its CVSS vector describes network reachability without privileges or user interaction, but the source only demonstrates the fault through a specific forwarding workload. Malicious remote triggering is therefore not established by this bundle.
Researcher notes
The bundle lists versions and commit hashes without explicit affected-range syntax, limiting precise version conclusions. Determine exposure through distribution advisories, package changelogs, or fix-commit ancestry. No CWE is supplied, and the evidence demonstrates an availability failure rather than proven confidentiality or integrity impact.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable referenced stable fix, then reboot affected systems.
- Prioritize gateways performing non-offloaded IPsec and GRE forwarding.
- Check distribution or Linux vendor guidance for exact corrected package versions.
- If updating is delayed, seek vendor-supported temporary mitigations for the affected forwarding path.
Validation and detection
- Inventory kernel builds and identify systems performing non-offloaded IPsec and GRE forwarding.
- Verify each deployed kernel package includes the applicable referenced stable fix.
- Review kernel logs for “page_pool leak,” “Bad page state,” and related crashes.
- After updating, retest representative forwarding and monitor kernel stability.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-26953 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8291b4eac429c480386669444c6377573f5d8664CVE reference, Linux
- https://git.kernel.org/stable/c/1abb20a5f4b02fb3020f88456fc1e6069b3cdc45CVE reference, Linux
- https://git.kernel.org/stable/c/f278ff9db67264715d0d50e3e75044f8b78990f4CVE reference, Linux
- https://git.kernel.org/stable/c/c3198822c6cb9fb588e446540485669cc81c5d34CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.