CVE-2024-26735: Linux Kernel Use-After-Free Vulnerability

CVE-2024-26735 Overview

CVE-2024-26735 is a use-after-free and null pointer dereference vulnerability in the Linux kernel's IPv6 Segment Routing (SR) subsystem. The flaw stems from incorrect ordering during subsystem initialization, where the generic netlink family is registered before the pernet operations structure. A local attacker with low privileges can trigger the race condition to cause kernel memory corruption or a denial of service. The vulnerability is tracked under CWE-416: Use After Free and affects multiple Linux kernel versions along with derivative products from Debian and NetApp.

Critical Impact
Local attackers can trigger kernel-level use-after-free conditions, leading to system crashes and potential memory corruption in the IPv6 Segment Routing subsystem.

Affected Products

Linux Kernel (multiple versions including 6.8-rc1 through 6.8-rc5)
Debian Linux 10.0
NetApp appliances including 8300, 8700, A400, C400, H610C, H610S, H615C, and E-Series SANtricity OS Controller

Discovery Timeline

2024-04-03 - CVE-2024-26735 published to NVD
2024-06 - Debian LTS security announcements published
2024-11-01 - NetApp security advisory released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-26735

Vulnerability Analysis

The vulnerability resides in the IPv6 Segment Routing (SR) subsystem of the Linux kernel networking stack. The initialization sequence registers the generic netlink family before the corresponding pernet operations structure is properly set up. This creates a window where netlink handlers can be invoked while referencing uninitialized or partially initialized per-network-namespace state.

When a userspace process issues netlink commands targeting the SR family during this window, the kernel may access memory that has been freed or that points to a null structure. Both outcomes can result in kernel panic or unpredictable behavior. The flaw is classified as CWE-416, which covers use-after-free defects.

Root Cause

The root cause is an ordering bug in subsystem initialization. The pernet_operations structure must be registered before the generic netlink family becomes reachable by userspace. Without this ordering, netlink callbacks can dereference pernet state that either does not yet exist or has already been torn down. The upstream fix reorders these registration calls and adjusts error-handling paths to preserve consistency during initialization and teardown.

Attack Vector

Exploitation requires local access with low privileges. An attacker sends crafted netlink messages to the IPv6 SR generic netlink family during or near subsystem initialization. Successful exploitation triggers use-after-free or null pointer dereference, producing a kernel crash and denial of service. No user interaction is required beyond attacker-controlled netlink activity.

No public proof-of-concept exploit code has been published. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and no exploit is available in Exploit-DB. Technical details of the fix are available in the kernel commit history.

Detection Methods for CVE-2024-26735

Indicators of Compromise

Unexpected kernel oops or panic messages referencing IPv6 SR functions or seg6_genl_ops in system logs
Kernel crashes correlated with netlink activity on the SEG6 generic netlink family from non-root local processes
Systems running vulnerable Linux kernel versions (including 6.8-rc1 through 6.8-rc5) without the referenced stable patches applied

Detection Strategies

Monitor /var/log/kern.log and dmesg output for use-after-free indicators from KASAN-enabled kernels, particularly during the boot window
Audit installed kernel package versions across the fleet and cross-reference against fixed commits such as 5559cea2d5aa and 9e02973dbc6a
Track netlink socket creation targeting the NETLINK_GENERIC family from unprivileged users using auditd rules on socket() syscalls

Monitoring Recommendations

Enable kernel address sanitizer (KASAN) in test environments to surface use-after-free conditions during regression testing
Aggregate kernel logs to a central SIEM and alert on BUG: KASAN, general protection fault, or NULL pointer dereference events tied to IPv6 SR call stacks
Baseline expected netlink activity per host to detect anomalous local process behavior targeting kernel subsystems

How to Mitigate CVE-2024-26735

Immediate Actions Required

Apply the latest stable Linux kernel updates from your distribution vendor that include the referenced upstream commits
On Debian systems, install updates announced in Debian LTS Announcement #17 and Announcement #20
On NetApp appliances, follow remediation steps in the NetApp Security Advisory NTAP-20241101-0012
Restrict local shell access on multi-tenant systems until patches are deployed

Patch Information

Upstream fixes are available through multiple stable kernel branches. Relevant commits include 02b08db594e8, 5559cea2d5aa, 65c38f23d10f, 82831e3ff76e, 8391b9b651cf, 91b020aaa1e5, 953f42934533, and 9e02973dbc6a. Review the full list of kernel git commits and select the patch appropriate for your kernel branch.

Workarounds

If patching is not immediately feasible, restrict access to the CAP_NET_ADMIN capability and limit local user accounts on affected hosts
Consider disabling IPv6 Segment Routing functionality where operationally acceptable by not loading the relevant kernel modules
Enforce least-privilege policies to minimize the number of local users capable of interacting with kernel netlink interfaces

bash

# Verify running kernel version and check for applied patches
uname -r

# Check whether IPv6 SR is compiled or loaded
grep CONFIG_IPV6_SEG6_LWTUNNEL /boot/config-$(uname -r)
lsmod | grep seg6

# Debian: apply security updates
sudo apt update && sudo apt upgrade linux-image-$(uname -r | sed 's/.*-//')