CVE-2024-26642

What it actually does

The vulnerability permits creation of anonymous nftables sets that carry the timeout flag, bypassing intended input validation in the kernel's netfilter subsystem and resulting in high-impact denial of service.

Why it matters to the business

Systems running affected Linux kernels or container-related packages on AlmaLinux 8 may experience network stack instability or crashes, leading to degraded container networking and potential service outages; the low EPSS and lack of KEV listing indicate limited in-the-wild exploitation pressure.

How an attack unfolds

An attacker with local access crafts nftables rules that attempt to instantiate an anonymous set marked with a timeout, triggering the improper validation path in nf_tables and causing the kernel to mishandle the set, resulting in a crash or resource exhaustion.

How to fix it

Upgrade to the fixed versions provided for each package: fuse-overlayfs to 1.4.0-2.module_el8.6.0+2876+9ed4eae2, criu to 3.15-1.module_el8.6.0+2876+9ed4eae2, slirp4netns to 1.1.8-1.module_el8.6.0+2876+9ed4eae2, and the Linux kernel to commit e4988d8415bd0294d6f9f4a1e7095f8b50a97ca9 or later stable releases.

How to confirm the fix worked

Verify that the running kernel and listed packages match or exceed the fixed versions, then attempt to load nftables rules containing anonymous sets with timeout flags to confirm rejection occurs as expected.

Typical attack path

1. Obtain local shell access on a vulnerable system
2. Load or interact with nftables to create an anonymous set with the timeout flag
3. Trigger set evaluation or meter-related legacy paths to activate the flawed code
4. Cause kernel panic or denial of service affecting network filtering

How to detect it

Review system logs for kernel oops or panic entries related to nf_tables set handling, and inspect audit logs for unexpected nftables rule loads involving anonymous sets.

What your security team should do

• Prioritize kernel and container runtime package updates on all AlmaLinux 8 hosts
• Restrict unprivileged local access to nftables commands until patches are applied
• Monitor for availability-impacting events in network filtering subsystems