CVE-2024-26815

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.8.0

Description The vulnerability is related to the taprio parse tc entry() function in the Linux kernel, which does not correctly check the TCA TAPRIO TC ENTRY INDEX attribute. This allows an attacker to feed arbitrary negative values, potentially leading to a shift-out-of-bounds error. The vulnerability was reported by syzbot and is related to the net/sched/sch taprio.c file.

Recommendations To resolve the issue, update the Linux kernel to version 6.8.0 or later. If updating is not possible, consider disabling the taprio module or restricting access to the vulnerable net/sched/sch taprio.c file as a temporary workaround. However, the most effective solution is to apply the proper patch for the TCA TAPRIO TC ENTRY INDEX check in the taprio parse tc entry() function.

Note: The provided information does not specify the exact patch or version that fixes the vulnerability, but it is implied that versions prior to 6.8.0 are affected.