CVE-2024-26961: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26961 is a vulnerability in the Linux kernel's mac802154 subsystem, discovered in May 2024. The issue occurs in the mac802154_llsec_key_del() function, which improperly manages resources by freeing key resources directly without following the RCU (Read-Copy-Update) rules for waiting before the end of a grace period (NVD).

The vulnerability stems from a race condition in the mac802154_llsec_key_del() function where resources are freed without proper RCU synchronization. This can lead to a use-after-free condition when llsec_lookup_key() traverses the list of keys in parallel with a key deletion. The issue manifests as a refcount addition on 0, triggering kernel warnings and potential system instability. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability can result in use-after-free conditions in the kernel, potentially leading to system crashes, memory corruption, or privilege escalation. The issue affects various Linux kernel versions from 3.16 through 6.7.x (NVD).

The vulnerability requires local access and can be triggered through the IEEE 802.15.4 networking interface. It was discovered during testing by the Linux Verification Center (linuxtesting.org) (Kernel Patch).

The issue has been fixed by implementing proper RCU callback handling in the mac802154_llsec_key_del_rcu() function. The fix ensures that resources are properly released after the RCU grace period elapses. The patch has been backported to multiple stable kernel versions (Kernel Patch).