CVE-2024-26581
📋 TL;DR
A race condition vulnerability in the Linux kernel's netfilter nft_set_rbtree garbage collection could cause kernel memory corruption. This affects Linux systems using nftables firewall rules with interval sets. Attackers could potentially crash the system or execute arbitrary code with kernel privileges.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to denial of service or potential privilege escalation to kernel-level code execution.
Likely Case
System crash or instability when nftables with interval sets are actively modified under load.
If Mitigated
Limited impact if nftables not used or interval sets not configured.
🎯 Exploit Status
Exploitation requires local access or ability to trigger nftables garbage collection through network traffic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Multiple stable kernel versions with commits: 10e9cb393136, 1296c110c5a0, 2bab493a5624, 4cee42fcf54f, 60c0c230c6f0
Vendor Advisory: https://git.kernel.org/stable/c/
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from distribution vendor. 2. Reboot system to load new kernel. 3. Verify nftables rules function correctly after update.
🔧 Temporary Workarounds
Disable nftables interval sets
linuxRemove or avoid using interval sets in nftables configuration
nft delete rule <family> <table> <chain> <handle>
nft flush ruleset
Use iptables instead
linuxReplace nftables firewall rules with iptables legacy firewall
systemctl stop nftables
systemctl disable nftables
apt-get install iptables
🧯 If You Can't Patch
- Disable nftables entirely if not required for system functionality
- Implement strict network segmentation to limit potential attack surface
🔍 How to Verify
Check if Vulnerable:
Check kernel version and if nftables with interval sets are configured: uname -r && nft list ruleset | grep -i intervalCheck Version:
uname -rVerify Fix Applied:
Verify kernel version is updated and test nftables interval set modifications under load📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- Oops messages in dmesg
- nftables rule modification failures
Network Indicators:
- Unexpected firewall rule changes
- Network traffic anomalies
SIEM Query:
source="kernel" AND ("Oops" OR "panic" OR "nft")🔗 References
- https://git.kernel.org/stable/c/10e9cb39313627f2eae4cd70c4b742074e998fd8
- https://git.kernel.org/stable/c/1296c110c5a0b45a8fcf58e7d18bc5da61a565cb
- https://git.kernel.org/stable/c/2bab493a5624444ec6e648ad0d55a362bcb4c003
- https://git.kernel.org/stable/c/4cee42fcf54fec46b344681e7cc4f234bb22f85a
- https://git.kernel.org/stable/c/60c0c230c6f046da536d3df8b39a20b9a9fd6af0
- https://git.kernel.org/stable/c/6eb14441f10602fa1cf691da9d685718b68b78a9
- https://git.kernel.org/stable/c/b734f7a47aeb32a5ba298e4ccc16bb0c52b6dbf7
- https://git.kernel.org/stable/c/c60d252949caf9aba537525195edae6bbabc35eb
- https://git.kernel.org/stable/c/10e9cb39313627f2eae4cd70c4b742074e998fd8
- https://git.kernel.org/stable/c/1296c110c5a0b45a8fcf58e7d18bc5da61a565cb
- https://git.kernel.org/stable/c/2bab493a5624444ec6e648ad0d55a362bcb4c003
- https://git.kernel.org/stable/c/4cee42fcf54fec46b344681e7cc4f234bb22f85a
- https://git.kernel.org/stable/c/60c0c230c6f046da536d3df8b39a20b9a9fd6af0
- https://git.kernel.org/stable/c/6eb14441f10602fa1cf691da9d685718b68b78a9
- https://git.kernel.org/stable/c/b734f7a47aeb32a5ba298e4ccc16bb0c52b6dbf7
- https://git.kernel.org/stable/c/c60d252949caf9aba537525195edae6bbabc35eb
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
