{"dataType":"CVE_RECORD","cveMetadata":{"cveId":"CVE-2024-26640","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-02-19T14:20:24.137Z","datePublished":"2024-03-18T10:19:07.025Z","dateUpdated":"2026-05-11T20:01:18.709Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-05-11T20:01:18.709Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: add sanity checks to rx zerocopy\n\nTCP rx zerocopy intent is to map pages initially allocated\nfrom NIC drivers, not pages owned by a fs.\n\nThis patch adds to can_map_frag() these additional checks:\n\n- Page must not be a compound one.\n- page->mapping must be NULL.\n\nThis fixes the panic reported by ZhangPeng.\n\nsyzbot was able to loopback packets built with sendfile(),\nmapping pages owned by an ext4 file to TCP rx zerocopy.\n\nr3 = socket$inet_tcp(0x2, 0x1, 0x0)\nmmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x12, r3, 0x0)\nr4 = socket$inet_tcp(0x2, 0x1, 0x0)\nbind$inet(r4, &(0x7f0000000000)={0x2, 0x4e24, @multicast1}, 0x10)\nconnect$inet(r4, &(0x7f00000006c0)={0x2, 0x4e24, @empty}, 0x10)\nr5 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\\x00',\n    0x181e42, 0x0)\nfallocate(r5, 0x0, 0x0, 0x85b8)\nsendfile(r4, r5, 0x0, 0x8ba0)\ngetsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23,\n    &(0x7f00000001c0)={&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0,\n    0x0, 0x0, 0x0, 0x0}, &(0x7f0000000440)=0x40)\nr6 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\\x00',\n    0x181e42, 0x0)"}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/tcp.c"],"versions":[{"version":"93ab6cc69162775201587cc9da00d5016dc890e2","lessThan":"f48bf9a83b1666d934247cb58a9887d7b3127b6f","status":"affected","versionType":"git"},{"version":"93ab6cc69162775201587cc9da00d5016dc890e2","lessThan":"718f446e60316bf606946f7f42367d691d21541e","status":"affected","versionType":"git"},{"version":"93ab6cc69162775201587cc9da00d5016dc890e2","lessThan":"b383d4ea272fe5795877506dcce5aad1f6330e5e","status":"affected","versionType":"git"},{"version":"93ab6cc69162775201587cc9da00d5016dc890e2","lessThan":"d15cc0f66884ef2bed28c7ccbb11c102aa3a0760","status":"affected","versionType":"git"},{"version":"93ab6cc69162775201587cc9da00d5016dc890e2","lessThan":"1b8adcc0e2c584fec778add7777fe28e20781e60","status":"affected","versionType":"git"},{"version":"93ab6cc69162775201587cc9da00d5016dc890e2","lessThan":"577e4432f3ac810049cb7e6b71f4d96ec7c6e894","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/tcp.c"],"versions":[{"version":"4.18","status":"affected"},{"version":"0","lessThan":"4.18","status":"unaffected","versionType":"semver"},{"version":"5.10.210","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.149","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.77","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.16","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.7.4","lessThanOrEqual":"6.7.*","status":"unaffected","versionType":"semver"},{"version":"6.8","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"5.10.210"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"5.15.149"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"6.1.77"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"6.6.16"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"6.7.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"6.8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/f48bf9a83b1666d934247cb58a9887d7b3127b6f"},{"url":"https://git.kernel.org/stable/c/718f446e60316bf606946f7f42367d691d21541e"},{"url":"https://git.kernel.org/stable/c/b383d4ea272fe5795877506dcce5aad1f6330e5e"},{"url":"https://git.kernel.org/stable/c/d15cc0f66884ef2bed28c7ccbb11c102aa3a0760"},{"url":"https://git.kernel.org/stable/c/1b8adcc0e2c584fec778add7777fe28e20781e60"},{"url":"https://git.kernel.org/stable/c/577e4432f3ac810049cb7e6b71f4d96ec7c6e894"}],"title":"tcp: add sanity checks to rx zerocopy","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-26640","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-03-18T14:20:07.780920Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-06-04T17:48:57.803Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T00:07:19.826Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/f48bf9a83b1666d934247cb58a9887d7b3127b6f","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/718f446e60316bf606946f7f42367d691d21541e","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/b383d4ea272fe5795877506dcce5aad1f6330e5e","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/d15cc0f66884ef2bed28c7ccbb11c102aa3a0760","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/1b8adcc0e2c584fec778add7777fe28e20781e60","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/577e4432f3ac810049cb7e6b71f4d96ec7c6e894","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","tags":["x_transferred"]}]}]},"dataVersion":"5.2"}