CVE-2024-26950

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-26950
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-26950.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-26950
Downstream
Related
Published
2024-05-01T05:18:29.902Z
Modified
2026-05-14T03:52:57.202627847Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
wireguard: netlink: access device through ctx instead of peer
Details

In the Linux kernel, the following vulnerability has been resolved:

wireguard: netlink: access device through ctx instead of peer

The previous commit fixed a bug that led to a NULL peer->device being dereferenced. It's actually easier and faster performance-wise to instead get the device from ctx->wg. This semantically makes more sense too, since ctx->wg->peerallowedips.seq is compared with ctx->allowedipsseq, basing them both in ctx. This also acts as a defence in depth provision against freed peers.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26950.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
e7096c131e5161fa3b8e52a650d7719d2857adfd
Fixed
493aa6bdcffd90a4f82aa614fe4f4db0641b4068
Fixed
4be453271a882c8ebc28df3dbf9e4d95e6ac42f5
Fixed
09c3fa70f65175861ca948cb2f0f791e666c90e5
Fixed
c991567e6c638079304cc15dff28748e4a3c4a37
Fixed
93bcc1752c69bb309f4d8cfaf960ef1faeb34996
Fixed
d44bd323d8bb8031eef4bdc44547925998a11e47
Fixed
71cbd32e3db82ea4a74e3ef9aeeaa6971969c86f

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-26950.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.6.0
Fixed
5.10.215
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.154
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.84
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.24
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.7.12
Type
ECOSYSTEM
Events
Introduced
6.8.0
Fixed
6.8.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-26950.json"