CVE-2024-26950

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-26950
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-26950.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-26950
Downstream
Related
Published
2024-05-01T05:18:29.902Z
Modified
2026-03-20T12:35:19.372841Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
wireguard: netlink: access device through ctx instead of peer
Details

In the Linux kernel, the following vulnerability has been resolved:

wireguard: netlink: access device through ctx instead of peer

The previous commit fixed a bug that led to a NULL peer->device being dereferenced. It's actually easier and faster performance-wise to instead get the device from ctx->wg. This semantically makes more sense too, since ctx->wg->peerallowedips.seq is compared with ctx->allowedipsseq, basing them both in ctx. This also acts as a defence in depth provision against freed peers.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26950.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
e7096c131e5161fa3b8e52a650d7719d2857adfd
Fixed
493aa6bdcffd90a4f82aa614fe4f4db0641b4068
Fixed
4be453271a882c8ebc28df3dbf9e4d95e6ac42f5
Fixed
09c3fa70f65175861ca948cb2f0f791e666c90e5
Fixed
c991567e6c638079304cc15dff28748e4a3c4a37
Fixed
93bcc1752c69bb309f4d8cfaf960ef1faeb34996
Fixed
d44bd323d8bb8031eef4bdc44547925998a11e47
Fixed
71cbd32e3db82ea4a74e3ef9aeeaa6971969c86f

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-26950.json"