CVE-2021-46283

What it actually does

Missing initialization of nft_set_elem_expr_alloc in nf_tables_newset causes NULL pointer dereference and general protection fault when a local user sets a netfilter table expression inside their own namespace.

Why it matters to the business

Local users can crash affected Linux systems on demand, leading to unplanned downtime, service disruption, and the need for manual restarts or failover.

How an attack unfolds

An attacker with local access creates a user namespace, installs a netfilter table with an expression that exercises the uninitialized pointer path in nf_tables_newset, and triggers the NULL dereference to produce a kernel fault.

How to fix it

Upgrade the Linux kernel to a version containing commit ad9f151e560b016b6ad3280b48e42fa11e1a5440 or later; rebuild and reboot affected hosts.

How to confirm the fix worked

Verify the running kernel source contains commit ad9f151e560b016b6ad3280b48e42fa11e1a5440; test that creating netfilter sets in a user namespace no longer produces a NULL dereference.

Typical attack path

1. Obtain local shell or container access
2. Create a new user namespace
3. Invoke nf_tables API to create a set with an expression
4. Trigger the uninitialized pointer path resulting in DoS

How to detect it

Review dmesg and kernel logs for general protection faults or oops messages originating from nf_tables_newset or nft_set_elem_expr_alloc; correlate with user-namespace activity in audit logs.

• general protection fault.*nf_tables_newset
• NULL pointer dereference.*nft_set_elem_expr_alloc

What your security team should do

• Apply the referenced kernel commit or a newer stable release immediately on all exposed systems
• Restrict untrusted local or container access until patches are deployed
• Monitor kernel logs for nf_tables-related faults as an interim detection measure