CVE-2024-26855: net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
In the Linux kernel, the following vulnerability has been resolved:
net: ice: Fix potential NULL pointer dereference in icebridgesetlink()
The function icebridgesetlink() may encounter a NULL pointer dereference if nlmsgfindattr() returns NULL and brspec is dereferenced subsequently in nlaforeachnested(). To address this issue, add a check to ensure that brspec is not NULL before proceeding with the nested attribute iteration.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
net: ice: Fix potential NULL pointer dereference in icebridgesetlink()
The Linux kernel CVE team has assigned CVE-2024-26855 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024041724-CVE-2024-26855-ac0d@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26855?
CVE-2024-26855 has a medium severity level due to the potential for a NULL pointer dereference in the Linux kernel.
How do I fix CVE-2024-26855?
To address CVE-2024-26855, update the Linux kernel to version 5.4.272, 5.10.213, 5.15.152, 6.1.82, 6.6.22, 6.7.10, or 6.8.
What versions of the Linux kernel are vulnerable to CVE-2024-26855?
Versions of the Linux kernel prior to 5.4.272, 5.10.213, 5.15.152, 6.1.82, 6.6.22, 6.7.10, and 6.8 are vulnerable to CVE-2024-26855.
Which Linux distributions are affected by CVE-2024-26855?
CVE-2024-26855 affects various Linux distributions using vulnerable kernel versions, including those from Red Hat and Debian.
What specific function is impacted by CVE-2024-26855?
The ice_bridge_setlink() function is impacted by the potential NULL pointer dereference as outlined in CVE-2024-26855.