{"id":"CVE-2024-26739","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_mirred: don't override retval if we already lost the skb\n\nIf we're redirecting the skb, and haven't called tcf_mirred_forward(),\nyet, we need to tell the…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_mirred: don't override retval if we already lost the skb\n\nIf we're redirecting the skb, and haven't called tcf_mirred_forward(),\nyet, we need to tell the…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416"],"vendor":"debian","product":"debian_linux","affected":["debian_linux = 11.0","linux_kernel >= 4.19, < 5.10.238","linux_kernel >= 5.11, < 5.15.182","linux_kernel >= 5.16, < 6.1.136","linux_kernel >= 6.2, < 6.6.19","linux_kernel >= 6.7, < 6.7.7","linux_kernel = 6.8"],"patched":["linux_kernel 6.7.7"],"published":"2024-04-03","updated":"2026-08-04","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-26739","references":[{"url":"https://git.kernel.org/stable/c/0117fe0a4615a7c8d30d6ebcbf87332fbe63e6fd","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/28cdbbd38a4413b8eff53399b3f872fd4e80db9d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9d3ef89b6a5e9f2e940de2cef3d543be0be8dec5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e873e8f7d03a2ee5b77fb1a305c782fed98e2754","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f4e294bbdca8ac8757db436fc82214f3882fc7e7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/28cdbbd38a4413b8eff53399b3f872fd4e80db9d","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/f4e294bbdca8ac8757db436fc82214f3882fc7e7","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.00278,"epssPercentile":0.20523,"ingestedAt":"2026-08-05T10:46:48.392Z","slug":"CVE-2024-26739","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_mirred: don't override retval if we already lost the skb\n\nIf we're redirecting the skb, and haven't called tcf_mirred_forward(),\nyet, we need to tell the core to drop the skb by setting the retcode\nto SHOT. If we have called tcf_mirred_forward(), however, the skb\nis out of our hands and returning SHOT will lead to UaF.\n\nMove the retval override to the error path which actually need it.\n\n## Affected\n\n- `debian_linux = 11.0`\n- `linux_kernel >= 4.19, < 5.10.238`\n- `linux_kernel >= 5.11, < 5.15.182`\n- `linux_kernel >= 5.16, < 6.1.136`\n- `linux_kernel >= 6.2, < 6.6.19`\n- `linux_kernel >= 6.7, < 6.7.7`\n- `linux_kernel = 6.8`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.7.7`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}