What is the CVSS score of CVE-2024-26950?

CVE-2024-26950 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Linux Kernel are affected by CVE-2024-26950?

A NULL pointer dereference in the Linux kernel's WireGuard networking subsystem (CVE-2024-26950) enables local authenticated users with network administration privileges to trigger kernel panics or…. A patch is available.

How to fix or mitigate CVE-2024-26950?

Within 24 hours, conduct a complete inventory of Linux systems running WireGuard to identify those running affected kernel versions across the impacted stable branches. Within 7 days, apply vendor-released kernel patches available across seven stable commits to staging environments, validating stability before production rollout. Within 30 days, deploy patches to all production systems and verify remediation through kernel version audits and configuration management system scans.

Linux Kernel CVE-2024-26950

HIGH

NULL Pointer Dereference (CWE-476)

2024-05-01 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Denial Of Service Linux Null Pointer Dereference Debian Debian Linux

7.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local attack vector confirmed; PR:L reflects CAP_NET_ADMIN requirement, achievable by non-root in namespaced containers; all CIA impacts high given kernel-level access on successful exploitation.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 13:13 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 13:10 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 11:23 NVD

MEDIUM HIGH

CVSS changed

Aug 04, 2026 - 11:23 NVD

5.5 (MEDIUM) 7.8 (HIGH)

CVE Published

May 01, 2024 - 06:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wireguard: netlink: access device through ctx instead of peer

The previous commit fixed a bug that led to a NULL peer->device being dereferenced. It's actually easier and faster performance-wise to instead get the device from ctx->wg. This semantically makes more sense too, since ctx->wg->peer_allowedips.seq is compared with ctx->allowedips_seq, basing them both in ctx. This also acts as a defence in depth provision against freed peers.

AnalysisAI

NULL pointer dereference in the Linux kernel's WireGuard netlink subsystem allows a local authenticated attacker with CAP_NET_ADMIN privileges to potentially cause a kernel panic or achieve kernel-level code execution. The flaw arises when the device pointer is accessed through a peer object that may have been freed, rather than through the safer context structure (ctx->wg). Multiple stable kernel branches are affected, and vendor patches are available across seven stable commits. EPSS is 0.01% (3rd percentile) and no CISA KEV listing exists, indicating no public exploit identified at time of analysis.

Technical ContextAI

WireGuard is a modern VPN protocol implemented directly in the Linux kernel since v5.6. Its netlink interface is used to configure peers, allowed IPs, and device settings. The vulnerability (CWE-476, NULL Pointer Dereference) exists in the netlink peer-handling path, where code previously accessed the WireGuard device via peer->device rather than through the safer ctx->wg reference. If a peer object has been freed or is in an inconsistent state, dereferencing peer->device yields a NULL pointer, leading to a kernel oops or panic. The fix also serves as defense-in-depth against use-after-free conditions on freed peers. Affected products per CPE data include linux:linux_kernel across multiple version ranges and debian:debian_linux:10.0 (Buster LTS).

RemediationAI

Apply the upstream kernel stable patches available at the seven git.kernel.org stable-tree commits referenced in the NVD entry (e.g., https://git.kernel.org/stable/c/09c3fa70f65175861ca948cb2f0f791e666c90e5 and siblings). Debian Buster users should apply the security update announced at https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html. Downstream distributions (Ubuntu, RHEL, SUSE, etc.) should be checked for their respective kernel update advisories incorporating these stable patches. As a compensating control where patching is not immediately possible, administrators can remove or not load the WireGuard kernel module (rmmod wireguard) on systems where WireGuard is not operationally required - note this disables all WireGuard VPN functionality. Restricting CAP_NET_ADMIN to trusted users and auditing container configurations that grant this capability reduces the attacker surface. Exact fixed kernel versions per distribution are not independently confirmed from the available input data.