PT-2024-7293 · Linux+5 · Linux Kernel+5

Published 2024-02-12 · Updated 2025-09-29 · CVE-2024-26708

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The issue is related to a race condition in the mptcp component of the Linux kernel, where Fastopen and PM-trigger subflow shutdown can race, as reported by syzkaller. The subflow status can change again before the subflow state change callback is invoked. This issue can be addressed by copying all the states directly reachable from TCP FIN WAIT1. The exploitation of this issue may allow an attacker to cause a denial of service.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

ALSA-2025_12746

ALSA-2025_12752

ALSA-2025_12753

ALSA-2025_16880

BDU:2024-08647

CVE-2024-26708

INFSA-2024_9315

OPENSUSE-SU-2025_0847-1

OPENSUSE-SU-2025_0856-1

OPENSUSE-SU-2025_0955-1

RHSA-2024:9315

RHSA-2024_9315

SUSE-SU-2025:0784-1

SUSE-SU-2025:0847-1

SUSE-SU-2025:0856-1

SUSE-SU-2025:0955-1

SUSE-SU-2025:20190-1

SUSE-SU-2025:20192-1

SUSE-SU-2025:20260-1

SUSE-SU-2025:20270-1

SUSE-SU-2025_0847-1

SUSE-SU-2025_0856-1

SUSE-SU-2025_0955-1

USN-6895-1

USN-6895-2

USN-6895-3

USN-6895-4

USN-6900-1

Affected Products

Linuxmint

Linux Kernel

Red Hat

Red Os

Suse

Ubuntu

References · 957

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26708.json · Exploit
• https://ubuntu.com/security/CVE-2023-52642 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26698 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26601 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26602 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52643 · Vendor Advisory
• https://git.kernel.org/stable/c/4bfe217e075d04e63c092df9d40c608e598c2ef2 · Patch
• https://ubuntu.com/security/notices/USN-6895-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26830 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26718 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26919 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26917 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26603 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6895-4 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52645 · Vendor Advisory