CVE-2024-26849

What it actually does

Missing entries for NLA_BE16 and NLA_BE32 (and similar types) in the minlen array cause nla_validate_range_unsigned and related functions in lib/nlattr.c to perform an out-of-bounds read when a policy declares NLA_POLICY_MAX(NLA_BE32, ...) but the supplied attribute is smaller than expected, resulting in use of uninitialized memory.

Why it matters to the business

Affected Ubuntu kernels on servers and workstations can experience crashes or unpredictable behavior when processing crafted netlink messages, leading to service outages and the need for kernel upgrades across a wide range of long-supported releases.

How an attack unfolds

An attacker with local access crafts a netlink message containing an undersized NLA_BE32 attribute that matches an NFTA_TARGET_REV-style policy, sends it via a userspace netlink socket, and triggers the validation path in __nla_validate_parse that reads past the attribute buffer.

How to fix it

Upgrade the Linux kernel packages to the following fixed versions or newer: linux 3.11.0-12.19 (14.04), 4.4.0-2.16 (16.04), 4.13.0-16.19 (18.04), 5.4.0-9.12 (20.04) and the corresponding linux-aws, linux-azure, linux-gcp, linux-hwe, linux-kvm, linux-oracle, and linux-lts-xenial packages listed in the CVE advisory; reboot after installation.

How to confirm the fix worked

Verify the running kernel version matches or exceeds one of the listed fixed package versions, then confirm absence of the minlen array gap by inspecting the patched nlattr.c or by running a reproducer that previously triggered KMSAN.

Typical attack path

1. Obtain local shell or process execution on an affected system
2. Construct a netlink attribute with length smaller than the expected BE32 size while matching an NLA_POLICY_MAX entry
3. Transmit the malformed message over a netlink socket that reaches the nftables or similar subsystem
4. Trigger the validation code path that performs the uninitialized read

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for KMSAN or BUG reports mentioning nla_validate_range_unsigned, validate_nla, or __nla_validate_parse; correlate with processes that open netlink sockets and send NFTA_* attributes.

What your security team should do

• Prioritize kernel upgrades on all exposed Ubuntu systems within the next maintenance window
• Restrict unprivileged netlink usage via LSM or seccomp where feasible until patches are applied
• Monitor for kernel oops or KMSAN reports referencing nla_validate functions