CVE-2024-26668

What it actually does

In the Linux kernel netfilter nft_limit module, configurations specifying extremely high rates (such as 17 GB/s) allow the internal token counter to wrap around due to integer overflow, producing incorrect rate limiting instead of being rejected.

Why it matters to the business

Organizations running affected kernels may experience unexpected network traffic behavior under rare, extreme high-throughput configurations, potentially leading to misapplied rate limits in firewalls or network controls; low prevalence and very high rate requirement reduce overall operational risk.

How an attack unfolds

An attacker or misconfigured system supplies an nft_limit rule with an excessively large rate value that triggers integer wraparound in the token counter; the kernel previously accepted the config, resulting in incorrect rate limiting behavior rather than rejecting the invalid setting.

How to fix it

Update the Linux kernel to a version containing commit 79d4efd75e7dbecd855a3b8a63e65f7265f466e1 or later; rebuild and deploy the updated kernel across affected systems.

How to confirm the fix worked

Verify the running kernel includes commit 79d4efd75e7dbecd855a3b8a63e65f7265f466e1; test nft_limit configuration with large rate values to confirm rejection occurs.

Typical attack path

1. Identify a system using nft_limit rules in netfilter
2. Craft a configuration with an extremely large rate value exceeding normal bounds
3. Apply the configuration to trigger token counter wraparound
4. Observe or exploit resulting incorrect rate limit enforcement

How to detect it

Review kernel logs and netfilter configuration files for nft_limit rules containing unusually large rate values; check for any post-configuration anomalies in traffic accounting.

What your security team should do

• Prioritize kernel updates on systems using netfilter nft_limit rules
• Audit existing nft_limit configurations for any excessively large rate values
• Monitor for future kernel updates addressing similar input validation issues