CVE-2024-26752

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-26752
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26752.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-26752
Downstream
BELL (1)
CLSA (4)
DEBIAN (1)
OESA (6)
SUSE (3)
UBUNTU (1)
Related
SUSE (3)
Published
2024-04-03T17:00:37Z
Modified
2026-10-20T10:30:26Z
Summary
l2tp: pass correct message length to ip6_append_data
Details

In the Linux kernel, the following vulnerability has been resolved:

l2tp: pass correct message length to ip6_append_data

l2tp_ip6_sendmsg needs to avoid accounting for the transport header twice when splicing more data into an already partially-occupied skbuff.

To manage this, we check whether the skbuff contains data using skb_queue_empty when deciding how much data to append using ip6_append_data.

However, the code which performed the calculation was incorrect:

 ulen = len + skb_queue_empty(&sk->sk_write_queue) ? transhdrlen : 0;

...due to C operator precedence, this ends up setting ulen to transhdrlen for messages with a non-zero length, which results in corrupted packets on the wire.

Add parentheses to correct the calculation in line with the original intent.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26752.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
559d697c5d072593d22b3e0bd8b8081108aeaf59
Fixed
4c3ce64bc9d36ca9164dd6c77ff144c121011aae
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
1fc793d68d50dee4782ef2e808913d5dd880bcc6
Fixed
c1d3a84a67db910ce28a871273c992c3d7f9efb5
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
96b2e1090397217839fcd6c9b6d8f5d439e705ed
Fixed
dcb4d14268595065c85dc5528056713928e17243
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
cd1189956393bf850b2e275e37411855d3bd86bb
Fixed
0da15a70395182ee8cb75716baf00dddc0bea38d
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
f6a7182179c0ed788e3755ee2ed18c888ddcc33f
Fixed
13cd1daeea848614e585b2c6ecc11ca9c8ab2500
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
9d4c75800f61e5d75c1659ba201b6c0c7ead3070
Fixed
804bd8650a3a2bf3432375f8c97d5049d845ce56
Fixed
83340c66b498e49353530e41542500fc8a4782d6
Fixed
359e54a93ab43d32ee1bff3c2f9f10cb9f6b6e79
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4.19.296
Fixed
4.19.308
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.4.258
Fixed
5.4.270
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.10.198
Fixed
5.10.211
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.15.135
Fixed
5.15.150
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.1.57
Fixed
6.1.80
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4.14.327
Fixed
4.15
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.5.7
Fixed
6.6
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
7626b9fed53092aa2147978070e610ecb61af844
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
fe80658c08e3001c80c5533cd41abfbb0e0e28fd

Affected versions

v4.*
v4.14.327
v4.14.328
v4.14.329
v4.14.330
v4.14.331
v4.14.332
v4.14.333
v4.14.334
v4.14.335
v4.14.336
v4.19.296
v4.19.297
v4.19.298
v4.19.299
v4.19.300
v4.19.301
v4.19.302
v4.19.303
v4.19.304
v4.19.305
v4.19.306
v4.19.307
v5.*
v5.10.198
v5.10.199
v5.10.200
v5.10.201
v5.10.202
v5.10.203
v5.10.204
v5.10.205
v5.10.206
v5.10.207
v5.10.208
v5.10.209
v5.10.210
v5.15.135
v5.15.136
v5.15.137
v5.15.138
v5.15.139
v5.15.140
v5.15.141
v5.15.142
v5.15.143
v5.15.144
v5.15.145
v5.15.146
v5.15.147
v5.15.148
v5.15.149
v5.4.258
v5.4.259
v5.4.260
v5.4.261
v5.4.262
v5.4.263
v5.4.264
v5.4.265
v5.4.266
v5.4.267
v5.4.268
v5.4.269
v6.*
v6.1.57
v6.1.58
v6.1.59
v6.1.60
v6.1.61
v6.1.62
v6.1.63
v6.1.64
v6.1.65
v6.1.66
v6.1.67
v6.1.68
v6.1.69
v6.1.70
v6.1.71
v6.1.72
v6.1.73
v6.1.74
v6.1.75
v6.1.76
v6.1.77
v6.1.78
v6.1.79
v6.5.10
v6.5.11
v6.5.12
v6.5.13
v6.5.7
v6.5.8
v6.5.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26752.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.19.308
Type
ECOSYSTEM
Events
Introduced
4.20.0
Fixed
5.4.270
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.211
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.150
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.80
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.19
Type
ECOSYSTEM
Events
Introduced
6.6.0
Fixed
6.7.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26752.json"