{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-26856", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.183Z", "datePublished": "2024-04-17T10:17:18.475Z", "dateUpdated": "2025-05-04T08:58:04.898Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-04T08:58:04.898Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sparx5: Fix use after free inside sparx5_del_mact_entry\n\nBased on the static analyzis of the code it looks like when an entry\nfrom the MAC table was removed, the entry was still used after being\nfreed. More precise the vid of the mac_entry was used after calling\ndevm_kfree on the mac_entry.\nThe fix consists in first using the vid of the mac_entry to delete the\nentry from the HW and after that to free it."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c"], "versions": [{"version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "lessThan": "e46274df1100fb0c06704195bfff5bfbd418bf64", "status": "affected", "versionType": "git"}, {"version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "lessThan": "0de693d68b0a18d5e256556c7c62d92cca35ad52", "status": "affected", "versionType": "git"}, {"version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "lessThan": "e83bebb718fd1f42549358730e1206164e0861d6", "status": "affected", "versionType": "git"}, {"version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "lessThan": "71809805b95052ff551922f11660008fb3666025", "status": "affected", "versionType": "git"}, {"version": "b37a1bae742f92cc9b1f777d54e04ee3d86bbfc2", "lessThan": "89d72d4125e94aa3c2140fedd97ce07ba9e37674", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c"], "versions": [{"version": "5.14", "status": "affected"}, {"version": "0", "lessThan": "5.14", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.152", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.82", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.22", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.10", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "5.15.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.1.82"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.6.22"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.7.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e46274df1100fb0c06704195bfff5bfbd418bf64"}, {"url": "https://git.kernel.org/stable/c/0de693d68b0a18d5e256556c7c62d92cca35ad52"}, {"url": "https://git.kernel.org/stable/c/e83bebb718fd1f42549358730e1206164e0861d6"}, {"url": "https://git.kernel.org/stable/c/71809805b95052ff551922f11660008fb3666025"}, {"url": "https://git.kernel.org/stable/c/89d72d4125e94aa3c2140fedd97ce07ba9e37674"}], "title": "net: sparx5: Fix use after free inside sparx5_del_mact_entry", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26856", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-01T19:36:26.233327Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:49:15.853Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.666Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/e46274df1100fb0c06704195bfff5bfbd418bf64", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0de693d68b0a18d5e256556c7c62d92cca35ad52", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e83bebb718fd1f42549358730e1206164e0861d6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/71809805b95052ff551922f11660008fb3666025", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/89d72d4125e94aa3c2140fedd97ce07ba9e37674", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/e46274df1100fb0c06704195bfff5bfbd418bf64", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0de693d68b0a18d5e256556c7c62d92cca35ad52", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e83bebb718fd1f42549358730e1206164e0861d6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/71809805b95052ff551922f11660008fb3666025", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/89d72d4125e94aa3c2140fedd97ce07ba9e37674", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.666Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26856", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-01T19:36:26.233327Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:24.047Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "net: sparx5: Fix use after free inside sparx5_del_mact_entry", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "b37a1bae742f", "lessThan": "e46274df1100", "versionType": "git"}, {"status": "affected", "version": "b37a1bae742f", "lessThan": "0de693d68b0a", "versionType": "git"}, {"status": "affected", "version": "b37a1bae742f", "lessThan": "e83bebb718fd", "versionType": "git"}, {"status": "affected", "version": "b37a1bae742f", "lessThan": "71809805b950", "versionType": "git"}, {"status": "affected", "version": "b37a1bae742f", "lessThan": "89d72d4125e9", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"status": "unaffected", "version": "0", "lessThan": "5.14", "versionType": "custom"}, {"status": "unaffected", "version": "5.15.152", "versionType": "custom", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.82", "versionType": "custom", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.22", "versionType": "custom", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.10", "versionType": "custom", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/e46274df1100fb0c06704195bfff5bfbd418bf64"}, {"url": "https://git.kernel.org/stable/c/0de693d68b0a18d5e256556c7c62d92cca35ad52"}, {"url": "https://git.kernel.org/stable/c/e83bebb718fd1f42549358730e1206164e0861d6"}, {"url": "https://git.kernel.org/stable/c/71809805b95052ff551922f11660008fb3666025"}, {"url": "https://git.kernel.org/stable/c/89d72d4125e94aa3c2140fedd97ce07ba9e37674"}], "x_generator": {"engine": "bippy-a5840b7849dd"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sparx5: Fix use after free inside sparx5_del_mact_entry\n\nBased on the static analyzis of the code it looks like when an entry\nfrom the MAC table was removed, the entry was still used after being\nfreed. More precise the vid of the mac_entry was used after calling\ndevm_kfree on the mac_entry.\nThe fix consists in first using the vid of the mac_entry to delete the\nentry from the HW and after that to free it."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-05-29T05:23:57.926Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26856", "state": "PUBLISHED", "dateUpdated": "2024-08-02T00:14:13.666Z", "dateReserved": "2024-02-19T14:20:24.183Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-17T10:17:18.475Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sparx5: Fix use after free inside sparx5_del_mact_entry\n\nBased on the static analyzis of the code it looks like when an entry\nfrom the MAC table was removed, the entry was still used after being\nfreed. More precise the vid of the mac_entry was used after calling\ndevm_kfree on the mac_entry.\nThe fix consists in first using the vid of the mac_entry to delete the\nentry from the HW and after that to free it."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: sparx5: corrige el use after free dentro de sparx5_del_mact_entry Seg\u00fan el an\u00e1lisis est\u00e1tico del c\u00f3digo, parece que cuando se elimin\u00f3 una entrada de la tabla MAC, la entrada todav\u00eda se us\u00f3 despu\u00e9s de ser liberado. M\u00e1s precisamente, el video de mac_entry se us\u00f3 despu\u00e9s de llamar a devm_kfree en mac_entry. La soluci\u00f3n consiste en utilizar primero el vid de mac_entry para eliminar la entrada del HW y luego liberarla."}], "id": "CVE-2024-26856", "lastModified": "2024-11-21T09:03:13.557", "metrics": {}, "published": "2024-04-17T11:15:08.740", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0de693d68b0a18d5e256556c7c62d92cca35ad52"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/71809805b95052ff551922f11660008fb3666025"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/89d72d4125e94aa3c2140fedd97ce07ba9e37674"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e46274df1100fb0c06704195bfff5bfbd418bf64"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e83bebb718fd1f42549358730e1206164e0861d6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/0de693d68b0a18d5e256556c7c62d92cca35ad52"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/71809805b95052ff551922f11660008fb3666025"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/89d72d4125e94aa3c2140fedd97ce07ba9e37674"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/e46274df1100fb0c06704195bfff5bfbd418bf64"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/e83bebb718fd1f42549358730e1206164e0861d6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: net: sparx5: Fix use after free inside sparx5_del_mact_entry", "id": "2275740", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2275740"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: sparx5: Fix use after free inside sparx5_del_mact_entry\nBased on the static analyzis of the code it looks like when an entry\nfrom the MAC table was removed, the entry was still used after being\nfreed. More precise the vid of the mac_entry was used after calling\ndevm_kfree on the mac_entry.\nThe fix consists in first using the vid of the mac_entry to delete the\nentry from the HW and after that to free it."], "name": "CVE-2024-26856", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26856\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26856\nhttps://lore.kernel.org/linux-cve-announce/2024041724-CVE-2024-26856-3dbf@gregkh/T"], "threat_severity": "Low"}

{"created": "2025-07-12T22:44:48.730993+00:00", "updated": "2025-07-12T22:44:48.731091+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}