VYPR
← All advisories
High severity7.8NVD Advisory· Published May 1, 2024· Updated May 12, 2026

CVE-2024-26961

CVE-2024-26961

Description

In the Linux kernel, the following vulnerability has been resolved:

mac802154: fix llsec key resources release in mac802154_llsec_key_del

mac802154_llsec_key_del() can free resources of a key directly without following the RCU rules for waiting before the end of a grace period. This may lead to use-after-free in case llsec_lookup_key() is traversing the list of keys in parallel with a key deletion:

refcount_t: addition on 0; use-after-free. WARNING: CPU: 4 PID: 16000 at lib/refcount.c:25 refcount_warn_saturate+0x162/0x2a0 Modules linked in: CPU: 4 PID: 16000 Comm: wpan-ping Not tainted 6.7.0 #19 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:refcount_warn_saturate+0x162/0x2a0 Call Trace:

llsec_lookup_key.isra.0+0x890/0x9e0 mac802154_llsec_encrypt+0x30c/0x9c0 ieee802154_subif_start_xmit+0x24/0x1e0 dev_hard_start_xmit+0x13e/0x690 sch_direct_xmit+0x2ae/0xbc0 __dev_queue_xmit+0x11dd/0x3c20 dgram_sendmsg+0x90b/0xd60 __sys_sendto+0x466/0x4c0 __x64_sys_sendto+0xe0/0x1c0 do_syscall_64+0x45/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76

Also, ieee802154_llsec_key_entry structures are not freed by mac802154_llsec_key_del():

unreferenced object 0xffff8880613b6980 (size 64): comm "iwpan", pid 2176, jiffies 4294761134 (age 60.475s) hex dump (first 32 bytes): 78 0d 8f 18 80 88 ff ff 22 01 00 00 00 00 ad de x......."....... 00 00 00 00 00 00 00 00 03 00 cd ab 00 00 00 00 ................ backtrace: [] __kmem_cache_alloc_node+0x1e2/0x2d0 [] kmalloc_trace+0x25/0xc0 [] mac802154_llsec_key_add+0xac9/0xcf0 [] ieee802154_add_llsec_key+0x5a/0x80 [] nl802154_add_llsec_key+0x426/0x5b0 [] genl_family_rcv_msg_doit+0x1fe/0x2f0 [] genl_rcv_msg+0x531/0x7d0 [] netlink_rcv_skb+0x169/0x440 [] genl_rcv+0x28/0x40 [] netlink_unicast+0x53c/0x820 [] netlink_sendmsg+0x93b/0xe60 [] ____sys_sendmsg+0xac5/0xca0 [] ___sys_sendmsg+0x11d/0x1c0 [] __sys_sendmsg+0xfa/0x1d0 [] do_syscall_64+0x45/0xf0 [] entry_SYSCALL_64_after_hwframe+0x6e/0x76

Handle the proper resource release in the RCU callback function mac802154_llsec_key_del_rcu().

Note that if llsec_lookup_key() finds a key, it gets a refcount via llsec_key_get() and locally copies key id from key_entry (which is a list element). So it's safe to call llsec_key_put() and free the list entry after the RCU grace period elapses.

Found by Linux Verification Center (linuxtesting.org).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2024-26961 fixes a use-after-free in the Linux kernel's IEEE 802.15.4 MAC layer, where a key deletion could race with key lookup, potentially allowing local privilege escalation.

Vulnerability (Root Cause)

CVE-2024-26961 is a use-after-free vulnerability in the Linux kernel's mac802154 subsystem, which implements the IEEE 802.15.4 wireless MAC layer. The function mac802154_llsec_key_del() can free memory associated with a security key without properly synchronizing via RCU (Read-Copy-Update) grace periods. This means the deletion can occur while another thread is in the middle of llsec_lookup_key(), which traverses the list of keys and increments a reference count on the key structure. Because the key is freed before all references are released, the reference count operation on the freed memory triggers a kernel warning and indicates a use-after-free condition. Additionally, the ieee802154_llsec_key_entry structures are not freed by mac802154_llsec_key_del(), leading to a memory leak [1].

Exploitation (Attack Surface & Prerequisites)

To exploit this vulnerability, an attacker would need local access to the system and the ability to trigger the race condition between a key deletion operation (e.g., via nl802154 commands like nl802154_add_llsec_key and subsequent deletion) and a key lookup operation (e.g., during transmission of a wpan-ping packet). The attacker does not need to send packets over the air; the race can be triggered entirely within the kernel's networking stack on the same host. The exploit requires precise timing to win the race, but the presence of a deterministic warning in the kernel log shows that the race can be reliably hit in practice [1].

Impact (Attacker Gain)

Successful exploitation of this use-after-free can lead to memory corruption, which an attacker may be able to leverage for local privilege escalation. The kernel warning message indicates that the reference count is decremented on a freed object, which can cause the kernel to write to freed memory. An attacker with the ability to trigger the race and control the freed memory's contents could potentially overwrite kernel structures and gain elevated privileges, including full root access. The vulnerability is rated High with a CVSS v3 score of 7.8 [1].

Mitigation

Status

The vulnerability is fixed in the Linux kernel by commit e8a1e58345cf (and backports to other stable versions) [4]. Users are advised to update their kernel to a version containing this fix. The Siemens advisory SSA-265688 lists this CVE among many others affecting the GNU/Linux subsystem of SIMATIC S7-1500 TM MFP products, which should be updated according to Siemens recommendations [1]. No workaround other than patching is currently available.

References
  1. SSA-265688
  2. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

163

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

9

News mentions

0

No linked articles in our index yet.