CVE-2024-26950

What it actually does

The flaw allows a NULL pointer dereference when WireGuard netlink code accesses a peer's device pointer after the peer has been freed or is in an inconsistent state.

Why it matters to the business

Local users on affected Linux systems can trigger kernel crashes leading to denial of service; high prevalence in Linux distributions increases exposure for servers and endpoints.

How an attack unfolds

An attacker with local access crafts netlink operations on a WireGuard interface that cause the code to follow a peer pointer whose device reference has become invalid, resulting in a NULL dereference and kernel panic.

How to fix it

Upgrade the Linux kernel to a version containing commit 493aa6bdcffd90a4f82aa614fe4f4db0641b4068 or later; apply the stable kernel update that resolves the WireGuard ctx access change.

How to confirm the fix worked

Confirm kernel version contains commit 493aa6bdcffd90a4f82aa614fe4f4db0641b4068; verify WireGuard netlink paths no longer dereference peer->device directly.

Typical attack path

1. Obtain local shell or user context on target Linux system
2. Interact with WireGuard netlink interface to manipulate peers or allowed IPs
3. Trigger condition where peer structure is freed while netlink context still references it
4. Cause kernel NULL dereference and system crash

How to detect it

Review kernel logs for NULL pointer dereference oops messages involving wireguard or netlink; inspect audit logs for unusual netlink activity on WireGuard interfaces.

What your security team should do

• Prioritize kernel upgrade on all WireGuard-enabled systems within standard patch windows
• Monitor for local privilege or DoS attempts targeting kernel netlink interfaces
• Review WireGuard configurations to limit unnecessary netlink exposure to untrusted local users