ZeroDay Findings
Sign inSign up

Findings

CVE-2024-26805

In the Linux kernel, the following vulnerability has been resolved: netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter syzbot reported the following uninit…

Published Apr 4, 2024 · updated Oct 15, 2026 · linux linux kernel

In the Linux kernel, the following vulnerability has been resolved: netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter syzbot reported the following uninit-value access issue [1]: netlink_to_full_skb() creates a new and puts the passed as a 1st arg of netlink_to_full_skb() onto new . The data size is specified as and passed to skb_put_data(). This is based on that is not data offset but buffer offset. The contains data and tailroom. Since the tailroom is not initialized when the new created, KMSAN detects uninitialized memory area when copying the data. This patch resolved this issue by correct the len from to , which is the actual data offset. BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:29 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:245 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:271 [inline] BUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:29 [inline] iterate_and_advance2 include/linux/iov_iter.h:245 [inline] iterate_and_advance include/linux/iov_iter.h:271 [inline] _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186 copy_to_iter include/linux/uio.h:197 [inline] simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:532 __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:420 skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546 skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline] packet_recvmsg+0xd9c/0x2000 net/packet/af_packet.c:3482 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg net/socket.c:1066 [inline] sock_read_iter+0x467

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 4, 2024 · NIST NVD

    Detected

    In the Linux kernel, the following vulnerability has been resolved: netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter syzbot reported the following uninit-value access issue [1]: netlink_to_full_skb() creates a new and puts the passed as a 1st arg of netlink_to_full_skb() onto new . The data size is specified as and passed to skb_put_data(). This is based on that is not data offset bu

  2. Oct 15, 2026 · NIST NVD

    Updated

    In the Linux kernel, the following vulnerability has been resolved: netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter syzbot reported the following uninit-value access issue [1]: netlink_to_full_skb() creates a new and puts the passed as a 1st arg of netlink_to_full_skb() onto new . The data size is specified as and passed to skb_put_data(). This is based on that is not data offset bu

Affected

  • cpe debian/debian linux10.0
  • cpe linux/linux kernelversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2024-26805

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2024-26805

    30-day exploitation probability 0.2%

    first.org
  • NIST NVDVulnerability recordCVE-2024-26805

    In the Linux kernel, the following vulnerability has been resolved: netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter syzbot reported the following uninit-value access issue [1]: netlink_to_full_skb() creates a new and puts the passed as a 1st ar

    nvd.nist.gov

References