CVE-2024-26921

What it actually does

Use-after-free in Linux kernel inet_defrag during skb fragment reassembly in the tx path (via netfilter, openvswitch, or ct_act) allows sk to be released while still referenced by ip_local_out and related functions, leading to kernel memory corruption or crash.

Why it matters to the business

Local attackers can crash affected Linux systems, causing denial of service, unplanned downtime, and potential loss of availability on servers and endpoints running vulnerable kernels; older Ubuntu LTS releases are widely impacted and require urgent updates.

How an attack unfolds

An attacker with local access crafts or triggers network traffic that causes skb fragments to be reassembled in the output path; when ip_defrag orphans the sk too early, subsequent use of the freed sk by ip_output or packet schedulers results in a use-after-free condition that can be leveraged for denial of service.

How to fix it

Upgrade to fixed kernel versions: linux 3.11.0-12.19 or later on Ubuntu 14.04, 4.4.0-2.16 on 16.04, 4.13.0-16.19 on 18.04, 5.4.0-9.12 on 20.04, and the corresponding fixed versions for linux-aws, linux-azure, linux-gcp, linux-hwe, linux-kvm, linux-oracle, and linux-hwe-edge packages listed in the advisory.

How to confirm the fix worked

Verify running kernel version against the fixed package list for each Ubuntu release; confirm absence of the vulnerable inet_defrag code paths by checking /proc/version or uname output and testing that fragment reassembly no longer triggers sk orphaning issues.

Typical attack path

1. Obtain local access or execute code on a vulnerable Linux system
2. Trigger or inject network packets that force fragment reassembly via netfilter or similar tx-path modules
3. Cause ip_defrag to release the sk while it remains referenced by ip_local_out or downstream functions
4. Trigger use-after-free leading to kernel panic or memory corruption

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for oops/panic messages involving ip_defrag, skb_orphan, or sk_buff sk references; look for unexpected process terminations or network stack crashes after fragment-heavy traffic; correlate with local user activity or packet generation tools.

What your security team should do

• Immediately apply the listed kernel updates on all affected Ubuntu systems
• Prioritize patching internet-facing and high-value Linux hosts first
• Monitor for kernel oops or panic logs referencing ip_defrag or skb sk handling
• Restrict local unprivileged access where possible until patches are deployed