CVE-2024-26861

What it actually does

Data race when concurrently accessing keypair->receiving_counter.counter from wg_packet_rx_poll (write) and wg_packet_decrypt_worker (read) without READ_ONCE/WRITE_ONCE, allowing inconsistent counter values during packet decryption and receive processing.

Why it matters to the business

Potential kernel instability or denial of service in WireGuard VPN tunnels on systems under heavy concurrent receive load, though exploitation requires specific local timing conditions and does not affect confidentiality or integrity.

How an attack unfolds

An attacker with local access triggers high-frequency packet processing on a WireGuard interface while a decryption worker is active, relying on scheduler and interrupt timing to hit the unsynchronized counter access and induce undefined behavior or crash.

How to fix it

Upgrade the Linux kernel to a version containing commit f87884e0dffd61b47e58bc6e1e2f6843c212b0cc which adds the required READ_ONCE and WRITE_ONCE annotations to receiving_counter.counter.

How to confirm the fix worked

Verify the presence of READ_ONCE/WRITE_ONCE around receiving_counter.counter accesses in drivers/net/wireguard/receive.c; re-run KCSAN on the affected paths and confirm absence of the reported data-race warning.

Typical attack path

1. Obtain local code execution or shell on the target host
2. Configure or attach to a WireGuard interface with active traffic
3. Generate sustained receive traffic to exercise the napi poll and decrypt worker paths concurrently
4. Trigger the race via scheduler preemption or interrupt timing to cause inconsistent counter state

How to detect it

Review kernel logs for KCSAN reports mentioning wg_packet_decrypt_worker or wg_packet_rx_poll; monitor for unexpected WireGuard interface resets or packet loss spikes coinciding with high interrupt load; no persistent post-exploitation artifacts are produced.

What your security team should do

• Apply the fixed kernel version containing commit f87884e0dffd61b47e58bc6e1e2f6843c212b0cc to all WireGuard-enabled systems
• Prioritize patching on high-traffic VPN gateways first due to increased race exposure
• Enable KCSAN in test environments to catch similar annotation issues before production deployment