llc: Drop support for ETH_P_TR_802_2.

{
  "id": "829fac7c7b60e4d462e1516f9a270e51b6d48c752fec287ec979be970a28283b",
  "url": "https://osv.dev/vulnerability/CVE-2024-26635",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "llc: Drop support for ETH_P_TR_802_2.",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: llc: Drop support for ETH_P_TR_802_2. syzbot reported an uninit-value bug below. [0] llc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2 (0x0011), and syzbot abused the latter to trigger the bug. write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, ')', \"90e5dd\"}}}}, 0x16) llc_conn_handler() initialises local variables {saddr,daddr}.mac based on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passes them to __llc_lookup(). However, the initialisation is done only when skb->protocol is htons(ETH_P_802_2), otherwise, __llc_lookup_established() and __llc_lookup_listener() will read garbage. The missing initialisation existed prior to commit 211ed865108e (\"net: delete all instances of special processing for token ring\"). It removed the part to kick out the token ring stuff but forgot to close the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv(). Let's remove llc_tr_packet_type and complete the deprecation. [0]: BUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90 __llc_lookup_established+0xe9d/0xf90 __llc_lookup net/llc/llc_conn.c:611 [inline] llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:791 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 __netif_receive_skb_one_core net/core/dev.c:5527 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641 netif_receive_skb_internal net/core/dev.c:5727 [inline] netif_receive_skb+0x58/0x660 ",
    "evidence": "osv:CVE-2024-26635",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "4.19.307",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.4.269",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.10.210",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.149",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.76",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.15",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.7.3",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2024-26635",
      "aliases": [
        "CVE-2024-26635"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "211ed865108e24697b44bee5daac502ee6bdd4a4"
                },
                {
                  "fixed": "165ad1e22779685c3ed3dd349c6c4c632309cc62"
                },
                {
                  "fixed": "b8e8838f82f332ae80c643dbb1ca4418d0628097"
                },
                {
                  "fixed": "9ccdef19cf9497c2803b005369668feb91cacdfd"
                },
                {
                  "fixed": "c0fe2fe7a5a291dfcf6dc64301732c8d3dc6a828"
                },
                {
                  "fixed": "660c3053d992b68fee893a0e9ec9159228cffdc6"
                },
                {
                  "fixed": "f1f34a515fb1e25e85dee94f781e7869ae351fb8"
                },
                {
                  "fixed": "df57fc2f2abf548aa889a36ab0bdcc94a75399dc"
                },
                {
                  "fixed": "e3f9bed9bee261e3347131764e42aeedf1ffea61"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26635.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "3.5.0"
                },
                {
                  "fixed": "4.19.307"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.20.0"
                },
                {
                  "fixed": "5.4.269"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.5.0"
                },
                {
                  "fixed": "5.10.210"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.149"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.76"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.15"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.7.3"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26635.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:26.333345184Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/165ad1e22779685c3ed3dd349c6c4c632309cc62",
        "https://git.kernel.org/stable/c/660c3053d992b68fee893a0e9ec9159228cffdc6",
        "https://git.kernel.org/stable/c/9ccdef19cf9497c2803b005369668feb91cacdfd",
        "https://git.kernel.org/stable/c/b8e8838f82f332ae80c643dbb1ca4418d0628097",
        "https://git.kernel.org/stable/c/c0fe2fe7a5a291dfcf6dc64301732c8d3dc6a828",
        "https://git.kernel.org/stable/c/df57fc2f2abf548aa889a36ab0bdcc94a75399dc",
        "https://git.kernel.org/stable/c/e3f9bed9bee261e3347131764e42aeedf1ffea61",
        "https://git.kernel.org/stable/c/f1f34a515fb1e25e85dee94f781e7869ae351fb8",
        "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html",
        "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26635.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2024-26635",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26635.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2024-26635",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 492709,
  "published_at": "2024-03-18T10:14:47.213+00:00"
}