Kernel Memory Leak Vulnerability in Linux Package: CVE-2024-26953
Summary
DEBIAN-CVE-2024-26953: In the Linux kernel, the following vulnerability has been resolved: net: esp: fix bad handling of pages from page_pool When the skb is reorganized during esp_output (!esp->inline), the pages coming from the original skb... Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It is responsible for handling system calls, memory management, and process scheduling. This package is critical for system stability and performance, making it a prime target for vulnerabilities that could compromise system integrity.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the handling of pages from the page_pool during the esp_output process. When the socket buffer (skb) is reorganized, pages originating from the original skb fragments should be released back to the system. However, if these pages come from a page_pool, calling put_page on them leads to a memory leak, which can eventually cause a system crash. This issue can be observed when using CONFIG_DEBUG_VM with IPsec and GRE forwarding, resulting in a bad page state error and potential system instability.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
The CVE-2024-26953 vulnerability in the Linux kernel poses a significant risk due to its potential to cause memory leaks and system crashes. Users are encouraged to update to the patched version 6.7.12-1 to mitigate this risk. Regular monitoring and prompt updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2024-26953 is a vulnerability in the Linux kernel that can lead to a memory leak and potential system crash due to improper handling of pages from the page_pool.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Symptoms may include system crashes, bad page state errors, and instability during network operations involving IPsec and GRE forwarding.
Yes, a patch is available in version 6.7.12-1 of the Linux package. It is recommended to update to this version to fix the vulnerability.
While there are no specific workarounds, it is crucial to monitor your system for any unusual behavior and apply the patch as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
