CVE-2024-26626: Vulnerability in Linux Linux
In the Linux kernel, the following vulnerability has been resolved: ipmr: fix kernel panic when forwarding mcast packets The stacktrace was: [ 86.305548] BUG: kernel NULL pointer dereference, address: 0000000000000092 [ 86.306815] #PF: supervisor read access in kernel mode [ 86.307717] #PF: error_code(0x0000) - not-present page [ 86.308624] PGD 0 P4D 0 [ 86.309091] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 86.309883] CPU: 2 PID: 3139 Comm: pimd Tainted: G U 6.8.0-6wind-knet #1 [ 86.311027] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.1-0-g0551a4be2c-prebuilt.qemu-project.org 04/01/2014 [ 86.312728] RIP: 0010:ip_mr_forward (/build/work/knet/net/ipv4/ipmr.c:1985) [ 86.313399] Code: f9 1f 0f 87 85 03 00 00 48 8d 04 5b 48 8d 04 83 49 8d 44 c5 00 48 8b 40 70 48 39 c2 0f 84 d9 00 00 00 49 8b 46 58 48 83 e0 fe <80> b8 92 00 00 00 00 0f 84 55 ff ff ff 49 83 47 38 01 45 85 e4 0f [ 86.316565] RSP: 0018:ffffad21c0583ae0 EFLAGS: 00010246 [ 86.317497] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 86.318596] RDX: ffff9559cb46c000 RSI: 0000000000000000 RDI: 0000000000000000 [ 86.319627] RBP: ffffad21c0583b30 R08: 0000000000000000 R09: 0000000000000000 [ 86.320650] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 [ 86.321672] R13: ffff9559c093a000 R14: ffff9559cc00b800 R15: ffff9559c09c1d80 [ 86.322873] FS: 00007f85db661980(0000) GS:ffff955a79d00000(0000) knlGS:0000000000000000 [ 86.324291] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 86.325314] CR2: 0000000000000092 CR3: 000000002f13a000 CR4: 0000000000350ef0 [ 86.326589] Call Trace: [ 86.327036] <TASK> [ 86.327434] ? show_regs (/build/work/knet/arch/x86/kernel/dumpstack.c:479) [ 86.328049] ? __die (/build/work/knet/arch/x86/kernel/dumpstack.c:421 /build/work/knet/arch/x86/kernel/dumpstack.c:434) [ 86.328508] ? page_fault_oops (/build/work/knet/arch/x86/mm/fault.c:707) [ 86.329107] ? do_user_addr_fault (/build/work/knet/arch/x86/mm/fault.c:1264) [ 86.329756] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223) [ 86.330350] ? __irq_work_queue_local (/build/work/knet/kernel/irq_work.c:111 (discriminator 1)) [ 86.331013] ? exc_page_fault (/build/work/knet/./arch/x86/include/asm/paravirt.h:693 /build/work/knet/arch/x86/mm/fault.c:1515 /build/work/knet/arch/x86/mm/fault.c:1563) [ 86.331702] ? asm_exc_page_fault (/build/work/knet/./arch/x86/include/asm/idtentry.h:570) [ 86.332468] ? ip_mr_forward (/build/work/knet/net/ipv4/ipmr.c:1985) [ 86.333183] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223) [ 86.333920] ipmr_mfc_add (/build/work/knet/./include/linux/rcupdate.h:782 /build/work/knet/net/ipv4/ipmr.c:1009 /build/work/knet/net/ipv4/ipmr.c:1273) [ 86.334583] ? __pfx_ipmr_hash_cmp (/build/work/knet/net/ipv4/ipmr.c:363) [ 86.335357] ip_mroute_setsockopt (/build/work/knet/net/ipv4/ipmr.c:1470) [ 86.336135] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223) [ 86.336854] ? ip_mroute_setsockopt (/build/work/knet/net/ipv4/ipmr.c:1470) [ 86.337679] do_ip_setsockopt (/build/work/knet/net/ipv4/ip_sockglue.c:944) [ 86.338408] ? __pfx_unix_stream_read_actor (/build/work/knet/net/unix/af_unix.c:2862) [ 86.339232] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223) [ 86.339809] ? aa_sk_perm (/build/work/knet/security/apparmor/include/cred.h:153 /build/work/knet/security/apparmor/net.c:181) [ 86.340342] ip_setsockopt (/build/work/knet/net/ipv4/ip_sockglue.c:1415) [ 86.340859] raw_setsockopt (/build/work/knet/net/ipv4/raw.c:836) [ 86.341408] ? security_socket_setsockopt (/build/work/knet/security/security.c:4561 (discriminator 13)) [ 86.342116] sock_common_setsockopt (/build/work/knet/net/core/sock.c:3716) [ 86.342747] do_sock_setsockopt (/build/work/knet/net/socket.c:2313) [ 86.343363] __sys_setsockopt (/build/work/knet/./include/linux/file.h:32 /build/work/kn ---truncated---
AI Analysis
Technical Summary
CVE-2024-26626 is a vulnerability identified in the Linux kernel affecting the IP multicast routing (ipmr) subsystem. Specifically, the flaw causes a kernel panic due to a NULL pointer dereference when forwarding multicast packets. The vulnerability manifests as a supervisor read access fault in kernel mode, triggered by a NULL pointer dereference at address 0x92. The stack trace indicates that the fault occurs in the ip_mr_forward function within the ipmr.c source file, which handles multicast packet forwarding. This bug leads to a system crash (kernel panic), resulting in a denial of service (DoS) condition. The vulnerability arises when multicast routing packets are processed, and the kernel attempts to access memory through an uninitialized or NULL pointer. The issue was identified and resolved in recent Linux kernel versions, but the affected versions include several commits prior to the fix. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet. The vulnerability does not appear to allow privilege escalation or remote code execution but can cause system instability and service disruption on affected systems handling multicast traffic.
Potential Impact
For European organizations, the impact of CVE-2024-26626 primarily involves potential denial of service conditions on Linux-based systems that perform IP multicast routing. This is particularly relevant for enterprises and service providers that rely on multicast for efficient distribution of data streams, such as IPTV services, financial trading platforms, or real-time data dissemination in industrial control systems. A kernel panic triggered by this vulnerability could lead to unexpected system reboots or crashes, causing service interruptions and potential data loss. Critical infrastructure operators and telecommunications providers in Europe that use Linux for network routing could face operational disruptions. Additionally, cloud service providers and data centers running Linux kernels with multicast routing enabled may experience instability affecting multiple tenants. While the vulnerability does not directly compromise confidentiality or integrity, the availability impact can be significant, especially in environments where uptime and continuous data flow are critical.
Mitigation Recommendations
European organizations should apply the following specific mitigation measures: 1) Immediately update Linux kernels to the latest patched versions that address CVE-2024-26626. Since the vulnerability is in the kernel multicast routing code, kernel updates from trusted Linux distributors (e.g., Debian, Ubuntu, Red Hat, SUSE) should be prioritized. 2) If immediate patching is not feasible, temporarily disable IP multicast routing features on affected systems to prevent triggering the vulnerability. This can be done by disabling multicast routing daemons or kernel modules related to ipmr. 3) Monitor system logs and kernel messages for signs of kernel panics or multicast routing errors to detect potential exploitation attempts or crashes. 4) Implement network segmentation to isolate multicast traffic and reduce exposure of critical systems to potentially malformed multicast packets. 5) For environments using custom or embedded Linux kernels, ensure that kernel builds incorporate the patch or backport the fix promptly. 6) Conduct thorough testing of updated kernels in staging environments before deployment to avoid regressions. 7) Maintain robust backup and recovery procedures to minimize downtime in case of system crashes caused by this vulnerability.
Affected Countries
Germany, France, United Kingdom, Netherlands, Sweden, Finland, Italy, Spain
CVE-2024-26626: Vulnerability in Linux Linux
Description
In the Linux kernel, the following vulnerability has been resolved: ipmr: fix kernel panic when forwarding mcast packets The stacktrace was: [ 86.305548] BUG: kernel NULL pointer dereference, address: 0000000000000092 [ 86.306815] #PF: supervisor read access in kernel mode [ 86.307717] #PF: error_code(0x0000) - not-present page [ 86.308624] PGD 0 P4D 0 [ 86.309091] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 86.309883] CPU: 2 PID: 3139 Comm: pimd Tainted: G U 6.8.0-6wind-knet #1 [ 86.311027] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.1-0-g0551a4be2c-prebuilt.qemu-project.org 04/01/2014 [ 86.312728] RIP: 0010:ip_mr_forward (/build/work/knet/net/ipv4/ipmr.c:1985) [ 86.313399] Code: f9 1f 0f 87 85 03 00 00 48 8d 04 5b 48 8d 04 83 49 8d 44 c5 00 48 8b 40 70 48 39 c2 0f 84 d9 00 00 00 49 8b 46 58 48 83 e0 fe <80> b8 92 00 00 00 00 0f 84 55 ff ff ff 49 83 47 38 01 45 85 e4 0f [ 86.316565] RSP: 0018:ffffad21c0583ae0 EFLAGS: 00010246 [ 86.317497] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 86.318596] RDX: ffff9559cb46c000 RSI: 0000000000000000 RDI: 0000000000000000 [ 86.319627] RBP: ffffad21c0583b30 R08: 0000000000000000 R09: 0000000000000000 [ 86.320650] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 [ 86.321672] R13: ffff9559c093a000 R14: ffff9559cc00b800 R15: ffff9559c09c1d80 [ 86.322873] FS: 00007f85db661980(0000) GS:ffff955a79d00000(0000) knlGS:0000000000000000 [ 86.324291] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 86.325314] CR2: 0000000000000092 CR3: 000000002f13a000 CR4: 0000000000350ef0 [ 86.326589] Call Trace: [ 86.327036] <TASK> [ 86.327434] ? show_regs (/build/work/knet/arch/x86/kernel/dumpstack.c:479) [ 86.328049] ? __die (/build/work/knet/arch/x86/kernel/dumpstack.c:421 /build/work/knet/arch/x86/kernel/dumpstack.c:434) [ 86.328508] ? page_fault_oops (/build/work/knet/arch/x86/mm/fault.c:707) [ 86.329107] ? do_user_addr_fault (/build/work/knet/arch/x86/mm/fault.c:1264) [ 86.329756] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223) [ 86.330350] ? __irq_work_queue_local (/build/work/knet/kernel/irq_work.c:111 (discriminator 1)) [ 86.331013] ? exc_page_fault (/build/work/knet/./arch/x86/include/asm/paravirt.h:693 /build/work/knet/arch/x86/mm/fault.c:1515 /build/work/knet/arch/x86/mm/fault.c:1563) [ 86.331702] ? asm_exc_page_fault (/build/work/knet/./arch/x86/include/asm/idtentry.h:570) [ 86.332468] ? ip_mr_forward (/build/work/knet/net/ipv4/ipmr.c:1985) [ 86.333183] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223) [ 86.333920] ipmr_mfc_add (/build/work/knet/./include/linux/rcupdate.h:782 /build/work/knet/net/ipv4/ipmr.c:1009 /build/work/knet/net/ipv4/ipmr.c:1273) [ 86.334583] ? __pfx_ipmr_hash_cmp (/build/work/knet/net/ipv4/ipmr.c:363) [ 86.335357] ip_mroute_setsockopt (/build/work/knet/net/ipv4/ipmr.c:1470) [ 86.336135] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223) [ 86.336854] ? ip_mroute_setsockopt (/build/work/knet/net/ipv4/ipmr.c:1470) [ 86.337679] do_ip_setsockopt (/build/work/knet/net/ipv4/ip_sockglue.c:944) [ 86.338408] ? __pfx_unix_stream_read_actor (/build/work/knet/net/unix/af_unix.c:2862) [ 86.339232] ? srso_return_thunk (/build/work/knet/arch/x86/lib/retpoline.S:223) [ 86.339809] ? aa_sk_perm (/build/work/knet/security/apparmor/include/cred.h:153 /build/work/knet/security/apparmor/net.c:181) [ 86.340342] ip_setsockopt (/build/work/knet/net/ipv4/ip_sockglue.c:1415) [ 86.340859] raw_setsockopt (/build/work/knet/net/ipv4/raw.c:836) [ 86.341408] ? security_socket_setsockopt (/build/work/knet/security/security.c:4561 (discriminator 13)) [ 86.342116] sock_common_setsockopt (/build/work/knet/net/core/sock.c:3716) [ 86.342747] do_sock_setsockopt (/build/work/knet/net/socket.c:2313) [ 86.343363] __sys_setsockopt (/build/work/knet/./include/linux/file.h:32 /build/work/kn ---truncated---
AI-Powered Analysis
Technical Analysis
CVE-2024-26626 is a vulnerability identified in the Linux kernel affecting the IP multicast routing (ipmr) subsystem. Specifically, the flaw causes a kernel panic due to a NULL pointer dereference when forwarding multicast packets. The vulnerability manifests as a supervisor read access fault in kernel mode, triggered by a NULL pointer dereference at address 0x92. The stack trace indicates that the fault occurs in the ip_mr_forward function within the ipmr.c source file, which handles multicast packet forwarding. This bug leads to a system crash (kernel panic), resulting in a denial of service (DoS) condition. The vulnerability arises when multicast routing packets are processed, and the kernel attempts to access memory through an uninitialized or NULL pointer. The issue was identified and resolved in recent Linux kernel versions, but the affected versions include several commits prior to the fix. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet. The vulnerability does not appear to allow privilege escalation or remote code execution but can cause system instability and service disruption on affected systems handling multicast traffic.
Potential Impact
For European organizations, the impact of CVE-2024-26626 primarily involves potential denial of service conditions on Linux-based systems that perform IP multicast routing. This is particularly relevant for enterprises and service providers that rely on multicast for efficient distribution of data streams, such as IPTV services, financial trading platforms, or real-time data dissemination in industrial control systems. A kernel panic triggered by this vulnerability could lead to unexpected system reboots or crashes, causing service interruptions and potential data loss. Critical infrastructure operators and telecommunications providers in Europe that use Linux for network routing could face operational disruptions. Additionally, cloud service providers and data centers running Linux kernels with multicast routing enabled may experience instability affecting multiple tenants. While the vulnerability does not directly compromise confidentiality or integrity, the availability impact can be significant, especially in environments where uptime and continuous data flow are critical.
Mitigation Recommendations
European organizations should apply the following specific mitigation measures: 1) Immediately update Linux kernels to the latest patched versions that address CVE-2024-26626. Since the vulnerability is in the kernel multicast routing code, kernel updates from trusted Linux distributors (e.g., Debian, Ubuntu, Red Hat, SUSE) should be prioritized. 2) If immediate patching is not feasible, temporarily disable IP multicast routing features on affected systems to prevent triggering the vulnerability. This can be done by disabling multicast routing daemons or kernel modules related to ipmr. 3) Monitor system logs and kernel messages for signs of kernel panics or multicast routing errors to detect potential exploitation attempts or crashes. 4) Implement network segmentation to isolate multicast traffic and reduce exposure of critical systems to potentially malformed multicast packets. 5) For environments using custom or embedded Linux kernels, ensure that kernel builds incorporate the patch or backport the fix promptly. 6) Conduct thorough testing of updated kernels in staging environments before deployment to avoid regressions. 7) Maintain robust backup and recovery procedures to minimize downtime in case of system crashes caused by this vulnerability.
Affected Countries
For access to advanced analysis and higher rate limits, contact root@offseq.com
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Linux
- Date Reserved
- 2024-02-19T14:20:24.135Z
- Cisa Enriched
- true
- Cvss Version
- null
- State
- PUBLISHED
Threat ID: 682d982bc4522896dcbe4213
Added to database: 5/21/2025, 9:08:59 AM
Last enriched: 6/29/2025, 9:25:59 PM
Last updated: 10/16/2025, 12:47:37 PM
Views: 27
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Related Threats
CVE-2025-9955: Vulnerability in WSO2 WSO2 Enterprise Integrator
MediumCVE-2025-10611: Vulnerability in WSO2 WSO2 API Manager
CriticalCVE-2025-58426: Use of hard-coded cryptographic key in NEOJAPAN Inc. desknet's NEO
MediumCVE-2025-58079: Improper Protection of Alternate Path in NEOJAPAN Inc. desknet's NEO
MediumCVE-2025-55072: Cross-site scripting (XSS) in NEOJAPAN Inc. desknet's NEO
MediumActions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.