{"id":"CVE-2024-26951","revision":"4d167946421d4daeb309eb0bdfb4ad65","records":[{"revision":"4d167946421d4daeb309eb0bdfb4ad65","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-26951","aliases":[],"title":"wireguard: netlink: check for dangling peer via is_dead instead of empty list","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwireguard: netlink: check for dangling peer via is_dead instead of empty list\n\nIf all peers are removed via wg_peer_remove_all(), rather than setting\npeer_list to empty, the peer is added to a temporary list with a head on\nthe stack of wg_peer_remove_all(). If a netlink dump is resumed and the\ncursored peer is one that has been removed via wg_peer_remove_all(), it\nwill iterate from that peer and then attempt to dump freed peers.\n\nFix this by instead checking peer->is_dead, which was explictly created\nfor this purpose. Also move up the device_update_lock lockdep assertion,\nsince reading is_dead relies on that.\n\nIt can be reproduced by a small script like:\n\n echo \"Setting config...\"\n ip link add dev wg0 type wireguard\n wg setconf wg0 /big-config\n (\n while true; do\n echo \"Showing config...\"\n wg showconf wg0 > /dev/null\n done\n ) &\n sleep 4\n wg setconf wg0 <(printf \"[Peer]\\nPublicKey=$(wg genkey)\\n\")\n\nResulting in:\n\n BUG: KASAN: slab-use-after-free in __lock_acquire+0x182a/0x1b20\n Read of size 8 at addr ffff88811956ec70 by task wg/59\n CPU: 2 PID: 59 Comm: wg Not tainted 6.8.0-rc2-debug+ #5\n Call Trace:\n \n dump_stack_lvl+0x47/0x70\n print_address_description.constprop.0+0x2c/0x380\n print_report+0xab/0x250\n kasan_report+0xba/0xf0\n __lock_acquire+0x182a/0x1b20\n lock_acquire+0x191/0x4b0\n down_read+0x80/0x440\n get_peer+0x140/0xcb0\n wg_get_device_dump+0x471/0x1130","state":0,"publishedAt":"2024-05-01T05:18:34.52+00:00","modifiedAt":"2026-10-15T00:39:32.705+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"drivers/net/wireguard/netlink.c\"\n ],\n \"versions\": [\n {\n \"version\": \"e7096c131e5161fa3b8e52a650d7719d2857adfd\",\n \"lessThan\": \"f52be46e3e6ecefc2539119784324f0cbc09620a\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"e7096c131e5161fa3b8e52a650d7719d2857adfd\",\n \"lessThan\": \"710a177f347282eea162aec8712beb1f42d5ad87\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"e7096c131e5161fa3b8e52a650d7719d2857adfd\",\n \"lessThan\": \"b7cea3a9af0853fdbb1b16633a458f991dde6aac\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"e7096c131e5161fa3b8e52a650d7719d2857adfd\",\n \"lessThan\": \"13d107794304306164481d31ce33f8fdb25a9c04\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"e7096c131e5161fa3b8e52a650d7719d2857adfd\",\n \"lessThan\": \"7bedfe4cfa38771840a355970e4437cd52d4046b\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"e7096c131e5161fa3b8e52a650d7719d2857adfd\",\n \"lessThan\": \"302b2dfc013baca3dea7ceda383930d9297d231d\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"e7096c131e5161fa3b8e52a650d7719d2857adfd\",\n \"lessThan\": \"55b6c738673871c9b0edae05d0c97995c1ff08c4\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"drivers/net/wireguard/netlink.c\"\n ],\n \"versions\": [\n {\n \"version\": \"5.6\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"5.6\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.10.215\",\n \"lessThanOrEqual\": \"5.10.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.154\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.84\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.24\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.7.12\",\n \"lessThanOrEqual\": \"6.7.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.8.3\",\n \"lessThanOrEqual\": \"6.8.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.9\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/f52be46e3e6ecefc2539119784324f0cbc09620a","https://git.kernel.org/stable/c/710a177f347282eea162aec8712beb1f42d5ad87","https://git.kernel.org/stable/c/b7cea3a9af0853fdbb1b16633a458f991dde6aac","https://git.kernel.org/stable/c/13d107794304306164481d31ce33f8fdb25a9c04","https://git.kernel.org/stable/c/7bedfe4cfa38771840a355970e4437cd52d4046b","https://git.kernel.org/stable/c/302b2dfc013baca3dea7ceda383930d9297d231d","https://git.kernel.org/stable/c/55b6c738673871c9b0edae05d0c97995c1ff08c4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-26951","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-26951","identifiers":["CVE-2024-26951"]},"retained":false,"historicalAffected":[]}],"coverage":[]}