PT-2024-1996 · Linux+2 · Linux Kernel+2

Published 2024-01-17 · Updated 2025-09-29 · CVE-2024-26587

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to a NULL pointer dereference in the mock phc destroy() function, which is called when trying to destroy netdevsim with VFs instantiated. This can cause a crash, as caught by running the devlink.sh test. The problem arises because PHC gets initialized in nsim init netdevsim(), which is only called if nsim dev port is pf() returns true. To fix this, a counterpart of nsim init netdevsim() is created and mock phc destroy() is moved there.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALSA-2025_16880

ALT-PU-2024-14046

ALT-PU-2024-6818

AZL-35906

BDU:2024-01847

CVE-2024-26587

Affected Products

Alt Linux

Linux Kernel

Red Os

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26587.json · Exploit
• https://git.kernel.org/stable/c/08aca65997fb6f233066883b1f1e653bcb1f26ca · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-26587 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-26587 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2024-26587 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-12682.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26587 · Security Note
• https://git.kernel.org/stable/c/ea937f77208323d35ffe2f8d8fc81b00118bfcda · Patch
• https://git.kernel.org/stable/c/c5068e442eed063d2f1658e6b6d3c1c6fcf1e588 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-26587 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26587 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-26587 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-26587 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01847 · Security Note
• https://osv.dev/vulnerability/AZL-35906 · Vendor Advisory