CVE-2024-26739

What it actually does

In the Linux kernel act_mirred action, returning SHOT after tcf_mirred_forward has already taken ownership of the skb leads to use-after-free when the core attempts to access the freed skb.

Why it matters to the business

Systems performing traffic control mirroring or redirection face risk of kernel instability or remote code execution; the vulnerability affects widely deployed Linux kernels with no ransomware usage reported and low exploit probability.

How an attack unfolds

An attacker sends specially crafted network traffic that reaches an act_mirred classifier; the skb is forwarded by tcf_mirred_forward yet the code path still overrides the return value to SHOT, triggering a use-after-free that can be leveraged for kernel memory corruption. Mention of Android kernel RCE threat actors indicates possible interest in similar kernel flaws.

How to fix it

Upgrade ua-parser/uap-core (GIT) to commit dc9925d458214cfe87b93e35346980612f6ae96c or later; apply the upstream kernel patch that relocates the retval override to the appropriate error path only.

How to confirm the fix worked

Confirm the patched commit is present in the running kernel source; exercise act_mirred redirect rules and verify no SHOT return occurs after forward; run regression tests on tc mirred actions.

Typical attack path

1. Send packets matching a tc filter that invokes act_mirred redirect
2. Trigger the code path where tcf_mirred_forward succeeds but error handling still executes
3. Force the kernel to dereference the now-freed skb
4. Exploit the resulting use-after-free for arbitrary read/write or code execution

How to detect it

Review kernel logs for use-after-free warnings or oops involving act_mirred or tcf_mirred; inspect netfilter or tc action traces showing unexpected skb lifetime handling; correlate with Android kernel RCE threat actor TTPs if observed in mobile or embedded deployments.

What your security team should do

• Prioritize patching all Linux systems using act_mirred within the next maintenance window given the 924-day exposure window
• Audit tc filter configurations that perform mirred redirects
• Monitor EPSS trend (stable at 0.0028) and any new exploit maturity signals
• Restrict untrusted traffic from reaching complex traffic-control classifiers until fixed