CVE-2024-26665
A bug in the Linux kernel could let a malicious network packet cause the system to read memory it shouldn’t, potentially crashing the kernel. The issue occurs when the kernel builds an IPv6 Path MTU (PMTU) error for certain non‑linear packets. It has been fixed in recent kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel 6.8 and earlier, including Debian 10.0. The vulnerability affects any system running those kernels, especially servers and network devices.
Real-world impact
An attacker could send crafted IPv6 packets that trigger the bug, causing the kernel to crash. This would make the affected machine unavailable until it is rebooted or patched.
Why this severity
The CVSS score of 9.1 reflects that the flaw can be exploited over the network without authentication or user interaction, and it can completely deny service by crashing the kernel.
What to do about it
- 01Upgrade the Linux kernel to version 6.8 or later, which contains the patch that replaces the unsafe checksum routine with a safe one.
- 02Restart the system to load the updated kernel.
NVD-referenced vendor advisory
Timeline
- Apr 2, 2024 · Apr 2, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 21h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/510c869ffa4068c5f1…patch
- git.kernel.org/stable/c/7dc9feb8b1705cf00d…patch
- git.kernel.org/stable/c/d75abeec401f8c86b4…patch
- git.kernel.org/stable/c/d964dd1bc1452594b4…patch
- git.kernel.org/stable/c/e37cde7a5716466ff2…patch
- git.kernel.org/stable/c/e77bf828f1ca1c47fc…patch
- lists.debian.org/debian-lts-announce/2024/06…mailing list