CVE-2024-26581

What it actually does

Use-after-free in nft_set_rbtree lazy garbage collection that can dereference an end-interval element still being inserted within the same transaction.

Why it matters to the business

Local attackers on affected Linux systems can escalate privileges or crash the kernel, leading to full system compromise or denial of service; high prevalence in servers and appliances increases exposure.

How an attack unfolds

An attacker with local access installs malicious nftables rules that create interval sets; the rbtree GC incorrectly reclaims a newly inserted end element, triggering the use-after-free that can be turned into arbitrary kernel code execution.

How to fix it

Upgrade the Linux kernel to a fixed release such as 5.4.269 or apply commit c60d252949caf9aba537525195edae6bbabc35eb; rebuild and reboot all affected systems.

How to confirm the fix worked

Confirm the running kernel version is at or above the fixed release; verify the patch is present by inspecting the nft_set_rbtree.c source for the end-interval skip logic.

Typical attack path

1. Obtain local user access on a vulnerable Linux host
2. Load or modify nftables configuration containing interval sets
3. Trigger repeated insert operations that race with lazy GC
4. Exploit resulting use-after-free for privilege escalation or kernel panic

How to detect it

Review kernel logs for oops or warnings referencing nft_set_rbtree; audit nftables rule changes and interval-set insertions around the time of any crash.

What your security team should do

• Immediately schedule kernel upgrades on all internet-facing and multi-tenant systems
• Restrict unprivileged users from loading nftables rules until patched
• Monitor EPSS and KEV updates for any change in exploit availability