What’s Vulnerable › Vulnerabilities

CVE-2024-26634: net: fix removing a namespace with conflicting altnames

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-18 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: net: fix removing a namespace with conflicting altnames Mark reports a BUG() when a net namespace is removed. kernel BUG at net/core/dev.c:11520! Physical interfaces moved outside of init_net get "refunded" to init_net when that namespace disappears. The main interface name may get overwritten in the process if it would have conflicted. We need to also discard all conflicting altnames. Recent fixes addressed ensuring that altnames get moved with the main interface, which surfaced this problem.

Affected products

• Linux kernel: from 6.1.60 before 6.1.76; from 6.6 before 6.6.15; from 6.7 before 6.7.3; 6.8-rc1 — fixed in 6.1.76, 6.6.15, 6.7.3

How to fix

Upgrade to a fixed version: Linux kernel 6.1.76, 6.6.15, 6.7.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/8072699aa9e67d1727692cfb3c347263bb627fb9
• https://git.kernel.org/stable/c/a2232f29bf52c24f827865b3c90829c44b6c695b
• https://git.kernel.org/stable/c/d09486a04f5da0a812c26217213b89a3b1acf836
• https://git.kernel.org/stable/c/e855dded4b70d1975ee7b9fed0c700391e3c8ea6
• https://git.kernel.org/stable/c/8072699aa9e67d1727692cfb3c347263bb627fb9
• https://git.kernel.org/stable/c/a2232f29bf52c24f827865b3c90829c44b6c695b
• https://git.kernel.org/stable/c/d09486a04f5da0a812c26217213b89a3b1acf836
• https://git.kernel.org/stable/c/e855dded4b70d1975ee7b9fed0c700391e3c8ea6

Get alerted when CVE-2024-26634 or the next vulnerability affects your stack