CVE-2024-26677: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26677 is a vulnerability discovered in the Linux kernel's RxRPC session sockets subsystem. The issue was identified and resolved in February 2024, specifically affecting the delayed ACKs functionality in the rxrpc component. The vulnerability relates to the incorrect setting of reference serial numbers in delayed ACKs, which could not be used as RTT (Round Trip Time) references (Kernel Git).

The vulnerability specifically involves the construction of delayed ACKs in the RxRPC subsystem. The issue stems from the improper setting of reference serial numbers in delayed acknowledgments, which were incorrectly being used as RTT references when they shouldn't have been. The fix involved removing the reference serial number setting functionality from delayed ACKs, as documented in the kernel patch. This was addressed by modifying the net/rxrpc/ar-internal.h and net/rxrpc/call_event.c files (Kernel Git).

The vulnerability affects various versions of the Linux kernel across multiple distributions. Ubuntu has classified this as a medium priority security issue, and it impacts multiple kernel versions including 5.15, 5.4, 4.15, and 4.4 series (Ubuntu Security).

The issue has been fixed in multiple Linux kernel versions. Ubuntu has released patches for various affected versions: Ubuntu 23.10 (6.5.0-44.44), Ubuntu 22.04 LTS (5.15.0-122.132), Ubuntu 20.04 LTS (5.4.0-196.216), Ubuntu 18.04 LTS (4.15.0-229.241), and Ubuntu 16.04 LTS (4.4.0-259.293). Users are advised to update their systems to the patched versions (Ubuntu Security).