Answer in brief
CVE-2024-26951 records a High severity (CVSS 7.8) vulnerability in wireguard: netlink: check for dangling peer via is_dead instead of empty list. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=e7096c131e5161fa3b8e52a650d7719d2857adfd <f52be46e3e6ecefc2539119784324f0cbc09620a || >=e7096c131e5161fa3b8e52a650d7719d2857adfd <710a177f347282eea162aec8712beb1f42d5ad87 || >=e7096c131e5161fa3b8e52a650d7719d2857adfd <b7cea3a9af0853fdbb1b16633a458f991dde6aac || >=e7096c131e5161fa3b8e52a650d7719d2857adfd <13d107794304306164481d31ce33f8fdb25a9c04 || >=e7096c131e5161fa3b8e52a650d7719d2857adfd <7bedfe4cfa38771840a355970e4437cd52d4046b || >=e7096c131e5161fa3b8e52a650d7719d2857adfd <302b2dfc013baca3dea7ceda383930d9297d231d || >=e7096c131e5161fa3b8e52a650d7719d2857adfd <55b6c738673871c9b0edae05d0c97995c1ff08c4 | f52be46e3e6ecefc2539119784324f0cbc09620a, 710a177f347282eea162aec8712beb1f42d5ad87, b7cea3a9af0853fdbb1b16633a458f991dde6aac, 13d107794304306164481d31ce33f8fdb25a9c04, 7bedfe4cfa38771840a355970e4437cd52d4046b, 302b2dfc013baca3dea7ceda383930d9297d231d, 55b6c738673871c9b0edae05d0c97995c1ff08c4 |
| Linux/Linuxgeneric | 5.6 | Not reported |
| Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystemgeneric | >=0 <* | * |
| Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystemgeneric | >=0 <V1.1.1 | V1.1.1 |
Published upstream
May 1, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: wireguard: netlink: check for dangling peer via is_dead instead of empty list If all peers are removed via wg_peer_remove_all(), rather than setting peer_list to empty, the peer is added to a temporary list with a head on the stack of wg_peer_remove_all(). If a netlink dump is resumed and the cursored peer is one that has been removed via wg_peer_remove_all(), it will iterate from that peer and then attempt to dump freed peers. Fix this by instead checking peer->is_dead, which was explictly created for this purpose. Also move up the device_update_lock lockdep assertion, since reading is_dead relies on that. It can be reproduced by a small script like: echo "Setting config..." ip link add dev wg0 type wireguard wg setconf wg0 /big-config ( while true; do echo "Showing config..." wg showconf wg0 > /dev/null done ) & sleep 4 wg setconf wg0 <(printf "[Peer]\nPublicKey=$(wg genkey)\n") Resulting in: BUG: KASAN: slab-use-after-free in __lock_acquire+0x182a/0x1b20 Read of size 8 at addr ffff88811956ec70 by task wg/59 CPU: 2 PID: 59 Comm: wg Not tainted 6.8.0-rc2-debug+ #5 Call Trace: <TASK> dump_stack_lvl+0x47/0x70 print_address_description.constprop.0+0x2c/0x380 print_report+0xab/0x250 kasan_report+0xba/0xf0 __lock_acquire+0x182a/0x1b20 lock_acquire+0x191/0x4b0 down_read+0x80/0x440 get_peer+0x140/0xcb0 wg_get_device_dump+0x471/0x1130
Quoted source text, attributed separately from HOL analysis.