net/sched: act_mirred: don't override retval if we already lost the skb
If we're redirecting the skb, and haven't called tcf_mirred_forward(),
yet, we need to tell the core to drop the skb by setting the retcode
to SHOT. If we have called tcf_mirred_forward(), however, the skb
is out of our hands and returning SHOT will lead to UaF.
Move the retval override to the error path which actually need it.
Metrics
Affected Vendors & Products
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-4193-1 | linux-6.1 security update |
Debian DLA |
DLA-4327-1 | linux security update |
Ubuntu USN |
USN-7654-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7654-2 | Linux kernel (Real-time) vulnerabilities |
Ubuntu USN |
USN-7654-3 | Linux kernel (FIPS) vulnerabilities |
Ubuntu USN |
USN-7654-4 | Linux kernel (KVM) vulnerabilities |
Ubuntu USN |
USN-7654-5 | Linux kernel (Xilinx ZynqMP) vulnerabilities |
Ubuntu USN |
USN-7655-1 | Linux kernel (Intel IoTG) vulnerabilities |
Ubuntu USN |
USN-7686-1 | Linux kernel (Raspberry Pi) vulnerabilities |
Ubuntu USN |
USN-7711-1 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-7712-1 | Linux kernel (Azure FIPS) vulnerabilities |
Ubuntu USN |
USN-7712-2 | Linux kernel (Azure) vulnerabilities |
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Mon, 03 Nov 2025 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Mon, 03 Nov 2025 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Wed, 04 Jun 2025 13:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Fri, 09 May 2025 08:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Fri, 02 May 2025 06:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Tue, 07 Jan 2025 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Linux
Linux linux Kernel |
|
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:* |
|
| Vendors & Products |
Linux
Linux linux Kernel |
|
| Metrics |
cvssV3_1
|
cvssV3_1
|
Tue, 24 Sep 2024 11:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat enterprise Linux
|
|
| CPEs | cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9 |
|
| Vendors & Products |
Redhat enterprise Linux
|
Wed, 11 Sep 2024 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Status: PUBLISHED
Assigner: Linux
Published:
Updated: 2025-11-03T19:29:31.734Z
Reserved: 2024-02-19T14:20:24.166Z
Link: CVE-2024-26739
Updated: 2025-11-03T19:29:31.734Z
Status : Modified
Published: 2024-04-03T17:15:51.367
Modified: 2025-11-03T20:16:10.607
Link: CVE-2024-26739
OpenCVE Enrichment
No data.
Debian DLA
Ubuntu USN