CVE-2024-26882: Linux Kernel Use-After-Free Vulnerability

CVE-2024-26882 Overview

CVE-2024-26882 is a Linux kernel vulnerability in the IPv4 tunnel receive path. The flaw resides in ip_tunnel_rcv() within net/ipv4/ip_tunnel.c, where the code fails to refresh the skb->network_header pointer after a call to pskb_inet_may_pull(). The pull operation can reallocate or modify the socket buffer head, leaving the previously cached pointer stale. Subsequent ECN decapsulation logic in __INET_ECN_decapsulate() then operates on uninitialized memory, as confirmed by a syzbot KMSAN report. The bug is conceptually identical to earlier issues fixed in __ip6_tnl_rcv() and geneve_rx(). Linux distributions including Debian, NetApp, and Siemens have issued advisories tracking this kernel defect.

Critical Impact
A local attacker delivering crafted GRE or IP-in-IP tunnel traffic through interfaces such as /dev/net/tun can trigger uninitialized memory reads in the kernel network stack, threatening confidentiality, integrity, and availability of the host.

Affected Products

Linux Kernel (multiple stable branches prior to the fix commits)
Debian LTS distributions shipping affected kernels
NetApp and Siemens products embedding vulnerable Linux kernel versions

Discovery Timeline

2024-04-17 - CVE-2024-26882 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2024-26882

Vulnerability Analysis

The defect is an uninitialized memory use [CWE-908-class] in the IPv4 tunnel ingress path. When a tunneled packet arrives, ip_tunnel_rcv() invokes pskb_inet_may_pull() to ensure the inner IP header is linear and accessible in skb->head. This call can reallocate the buffer, which invalidates any previously cached pointer derived from skb. The original code retained a stale network_header value and used it to compute the inner IP header address passed to IP_ECN_decapsulate(). KMSAN instrumentation flagged the resulting read inside __INET_ECN_decapsulate() as an uninit-value condition. The reporting stack trace traces the path through gre_rcv(), ip_protocol_deliver_rcu(), and ultimately tun_get_user() writes from userspace.

Root Cause

The root cause is a missed pointer recomputation after a buffer-reallocating helper. The fix saves skb->network_header into a local offset before calling pskb_inet_may_pull(), then rederives the header pointer after the pull succeeds. Without this, ECN decapsulation reads bytes that may lie outside any initialized region of the new buffer.

Attack Vector

Exploitation requires local access with the ability to write tunnel frames, typically via a TUN/TAP device. An unprivileged user with access to /dev/net/tun or a container with CAP_NET_ADMIN in its namespace can craft GRE-encapsulated packets that traverse ip_tunnel_rcv(). The uninitialized read can leak kernel stack or heap contents into protocol processing decisions, and adjacent memory corruption scenarios are plausible depending on kernel configuration.

No public proof-of-concept exploit is currently available. The vulnerability was identified through the syzbot fuzzing infrastructure. See the kernel commit references for the patched logic.

Detection Methods for CVE-2024-26882

Indicators of Compromise

Unexpected kernel KMSAN or KASAN reports referencing ip_tunnel_rcv or __INET_ECN_decapsulate in dmesg and journal logs.
Kernel oops or panic entries originating from gre_rcv or __ipgre_rcv call chains on hosts running unpatched kernels.
Anomalous use of /dev/net/tun by non-administrative users or unexpected container workloads writing crafted GRE frames.

Detection Strategies

Inventory running kernel versions across Linux fleets and compare against the fixed commits 5c03387021cf, 60044ab84836, 77fd5294ea09, b0ec2abf9826, c4c857723b37, ca914f1cdee8, ec6bb01e02cb, and f6723d8dbfdc.
Audit which processes and containers hold open file descriptors to /dev/net/tun and which namespaces have CAP_NET_ADMIN.
Enable auditd rules on tun_chr_write_iter ingress paths where supported, and forward kernel ring buffer events to a centralized log platform.

Monitoring Recommendations

Stream kernel logs and syscall telemetry to a centralized analytics platform and alert on crash signatures referencing tunnel receive functions.
Track creation of GRE, IPIP, and SIT tunnel interfaces on production hosts that should not host tunnels.
Correlate process-level telemetry from container runtimes with kernel-level tunnel activity to surface unexpected encapsulated traffic.

How to Mitigate CVE-2024-26882

Immediate Actions Required

Apply vendor-supplied kernel updates from your Linux distribution as soon as they are available and reboot affected hosts.
Restrict access to /dev/net/tun to trusted users and remove CAP_NET_ADMIN from container workloads that do not require it.
Disable unused tunnel modules such as ip_gre, ipip, and sit on hosts that do not require tunneling.

Patch Information

The upstream fix saves skb->network_header as an offset before calling pskb_inet_may_pull() and recomputes the inner header pointer afterward. Stable kernel commits include 5c03387021cf, 60044ab84836, 77fd5294ea09, b0ec2abf9826, c4c857723b37, ca914f1cdee8, ec6bb01e02cb, and f6723d8dbfdc. Distribution advisories are available from the Debian LTS Announcement, NetApp Security Advisory, and Siemens Product Security Advisory.

Workarounds

Blacklist tunnel kernel modules with modprobe.d entries for ip_gre, ipip, and sit where tunneling is not required.
Drop unsolicited GRE protocol 47 traffic at network boundaries to reduce remote pivot opportunities into the local code path.
Constrain container runtimes with seccomp and capability profiles that block creation of TUN devices in untrusted workloads.

bash

# Block unused tunnel modules and restrict /dev/net/tun access
echo 'install ip_gre /bin/true' | sudo tee /etc/modprobe.d/disable-ip_gre.conf
echo 'install ipip   /bin/true' | sudo tee /etc/modprobe.d/disable-ipip.conf
echo 'install sit    /bin/true' | sudo tee /etc/modprobe.d/disable-sit.conf
sudo chmod 0600 /dev/net/tun
sudo setcap -r /usr/bin/<binary-with-cap_net_admin> 2>/dev/null || true