High 7.8Published Apr 17, 2024

CVE-2024-26898aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts

Updated under an hour ago (Oct 27, 2026, 5:23 PM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts This patch is against CVE-2023-6270. The description of cve is: A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access through the `skbtxq` global queue. This could lead to a denial of service condition or potential code execution. In aoecmd_cfg_pkts(), it always calls dev_put(ifp) when skb initial code is finished. But the net_device ifp will still be used in later tx()->dev_queue_xmit() in kthread. Which means that the dev_put(ifp) should NOT be called in the success path of skb initial code in aoecmd_cfg_pkts(). Otherwise tx() may run into use-after-free because the net_device is freed. This patch removed the dev_put(ifp) in the success path in aoecmd_cfg_pkts(), and added dev_put() after skb xmit in tx().

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 7562f876cd93800f2f8c89445f2a563590b24e09 before ad80c34944d7175fa1f5c7a55066020002921a99; 7562f876cd93800f2f8c89445f2a563590b24e09 builds before 1a54aa506b3b2f31496731039e49778f54eee881; from 7562f876cd93800f2f8c89445f2a563590b24e09 before faf0b4c5e00bb680e8e43ac936df24d3f48c8e65; 7562f876cd93800f2f8c89445f2a563590b24e09 builds before 7dd09fa80b0765ce68bfae92f4e2f395ccf0fba4; 7562f876cd93800f2f8c89445f2a563590b24e09 builds before 74ca3ef68d2f449bc848c0a814cefc487bf755fa; from 7562f876cd93800f2f8c89445f2a563590b24e09 before eb48680b0255a9e8a9bdc93d6a55b11c31262e62; 7562f876cd93800f2f8c89445f2a563590b24e09 builds before 079cba4f4e307c69878226fdf5228c20aa1c969c; from 7562f876cd93800f2f8c89445f2a563590b24e09 before a16fbb80064634b254520a46395e36b87ca4731e; and 1 more ranges	CNA record
linux linux_kernel linux:linux_kernel	2.6.22	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	before V1.1.1	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
linux linux_kernel linux:linux_kernel	from 2.6.22 before 4.19.311; from 4.20 before 5.4.273; from 5.5 before 5.10.214; from 5.11 before 5.15.153; from 5.16 before 6.1.83; from 6.2 before 6.6.23; from 6.7 before 6.7.11; from 6.8 before 6.8.2	NVD

References

References

https://git.kernel.org/stable/c/ad80c34944d7175fa1f5c7a55066020002921a99	patch
https://git.kernel.org/stable/c/1a54aa506b3b2f31496731039e49778f54eee881	patch
https://git.kernel.org/stable/c/faf0b4c5e00bb680e8e43ac936df24d3f48c8e65	patch
https://git.kernel.org/stable/c/7dd09fa80b0765ce68bfae92f4e2f395ccf0fba4	patch
https://git.kernel.org/stable/c/74ca3ef68d2f449bc848c0a814cefc487bf755fa	patch
https://git.kernel.org/stable/c/eb48680b0255a9e8a9bdc93d6a55b11c31262e62	patch
https://git.kernel.org/stable/c/079cba4f4e307c69878226fdf5228c20aa1c969c	patch
https://git.kernel.org/stable/c/a16fbb80064634b254520a46395e36b87ca4731e	patch
https://git.kernel.org/stable/c/f98364e926626c678fb4b9004b75cacf92ff0662	patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
1–10 of 13

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.