CVE-2024-26643

What it actually does

Race condition in nf_tables allows asynchronous rhashtable GC to collect elements from anonymous sets with timeouts during release from commit path, fixed by marking sets dead to skip async GC.

Why it matters to the business

Local denial of service via kernel instability on affected Linux systems; widespread in Ubuntu LTS deployments increases operational risk and patch urgency.

How an attack unfolds

Local attacker creates nftables rules with anonymous timed sets, triggers concurrent commit and GC paths to hit the race before the dead flag fix.

How to fix it

Upgrade to fixed versions including Kernel 5.4.274, linux 5.4.0-9.12 (Ubuntu 20.04), linux 4.15.0-1007.9 (Ubuntu 18.04 Oracle), or equivalent per-package fixes listed for each affected Ubuntu release.

How to confirm the fix worked

Confirm updated kernel version matches fixed releases, verify nf_tables commit 08e4c8c5919f and related dead-flag changes are present, test nftables set creation/unbind under load.

Typical attack path

1. Gain local access on vulnerable kernel
2. Configure nftables anonymous set with timeout
3. Force transaction commit while GC runs
4. Trigger memory access violation or crash

How to detect it

Review kernel logs for nf_tables related crashes or warnings during set operations; audit nftables rule changes via auditd or journalctl for suspicious anonymous set activity.

What your security team should do

• Apply kernel updates immediately on all affected Ubuntu and Linux systems
• Limit unprivileged nftables usage via capabilities or SELinux
• Monitor kernel logs for nf_tables oops or panic entries