CVE-2024-26752

MEDIUM
Published Apr 3, 2024 Modified Mar 17, 2025 CWE-131

Description

In the Linux kernel, the following vulnerability has been resolved: l2tp: pass correct message length to ip6_append_data l2tp_ip6_sendmsg needs to avoid accounting for the transport header twice when splicing more data into an already partially-occupied skbuff. To manage this, we check whether the skbuff contains data using skb_queue_empty when deciding how much data to append using ip6_append_data. However, the code which performed the calculation was incorrect: ulen = len + skb_queue_empty(&sk->sk_write_queue) ? transhdrlen : 0; ...due to C operator precedence, this ends up setting ulen to transhdrlen for messages with a non-zero length, which results in corrupted packets on the wire. Add parentheses to correct the calculation in line with the original intent.

Is your site exposed to CVE-2024-26752?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.5
MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-131 CWE-131

Affected Products

Vendor Product
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
debian debian_linux

References

Advisories & Patches

https://git.kernel.org/stable/c/0da15a70395182ee8cb75716baf00dddc0bea38d https://git.kernel.org/stable/c/13cd1daeea848614e585b2c6ecc11ca9c8ab2500 https://git.kernel.org/stable/c/359e54a93ab43d32ee1bff3c2f9f10cb9f6b6e79 https://git.kernel.org/stable/c/4c3ce64bc9d36ca9164dd6c77ff144c121011aae https://git.kernel.org/stable/c/804bd8650a3a2bf3432375f8c97d5049d845ce56 https://git.kernel.org/stable/c/83340c66b498e49353530e41542500fc8a4782d6 https://git.kernel.org/stable/c/c1d3a84a67db910ce28a871273c992c3d7f9efb5 https://git.kernel.org/stable/c/dcb4d14268595065c85dc5528056713928e17243 https://git.kernel.org/stable/c/0da15a70395182ee8cb75716baf00dddc0bea38d https://git.kernel.org/stable/c/13cd1daeea848614e585b2c6ecc11ca9c8ab2500 https://git.kernel.org/stable/c/359e54a93ab43d32ee1bff3c2f9f10cb9f6b6e79 https://git.kernel.org/stable/c/4c3ce64bc9d36ca9164dd6c77ff144c121011aae https://git.kernel.org/stable/c/804bd8650a3a2bf3432375f8c97d5049d845ce56 https://git.kernel.org/stable/c/83340c66b498e49353530e41542500fc8a4782d6 https://git.kernel.org/stable/c/c1d3a84a67db910ce28a871273c992c3d7f9efb5 https://git.kernel.org/stable/c/dcb4d14268595065c85dc5528056713928e17243

Frequently Asked Questions

What is CVE-2024-26752? +
In the Linux kernel, the following vulnerability has been resolved: l2tp: pass correct message length to ip6_append_data l2tp_ip6_sendmsg needs to avoid accounting for the transport header twice when splicing more data into an already partially-occupied skbuff. To manage this, we check whether the skbuff contains data using skb_queue_empty when deciding how much data to append using ip6_append_data. However, the code which performed the calculation was incorrect: ulen = len + skb_queue_empty(&sk->sk_write_queue) ? transhdrlen : 0; ...due to C operator precedence, this ends up setting ulen to transhdrlen for messages with a non-zero length, which results in corrupted packets on the wire. Add parentheses to correct the calculation in line with the original intent. It has a CVSS v3.1 base score of 5.5 (MEDIUM).
How severe is CVE-2024-26752? +
CVE-2024-26752 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.
What products are affected by CVE-2024-26752? +
CVE-2024-26752 affects products from debian, linux, specifically: debian_linux, linux_kernel. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2024-26752? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-78221

An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to …
CVE-2026-27820

zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain …
CVE-2025-46723

OpenVM is a performant and modular zkVM framework built for customization and extensibility. In version 1.0.0, OpenVM is vulnerable to …
CVE-2026-45784

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers …
CVE-2026-41197

Noir is a Domain Specific Language for SNARK proving systems that is designed to use any ACIR compatible proving system, …
CVE-2026-95509

Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bounds reading.

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2024-26752 — free, no signup required.