CVE-2024-26673

What it actually does

The flaw permitted custom nft_ct expectations in the Linux kernel netfilter subsystem to accept disallowed layer-3 families (anything other than NFPROTO_IPV4, NFPROTO_IPV6 or NFPROTO_INET) and layer-4 protocols that lack port numbers, bypassing intended input validation.

Why it matters to the business

Linux systems using nftables for stateful connection tracking could experience rule misbehavior or unexpected kernel behavior in network filtering paths; the low EPSS and absence from KEV indicate limited real-world exploitation pressure, yet organizations running affected kernels still needed timely patching.

How an attack unfolds

An attacker with the ability to load or influence nftables rules creates a custom expectation object using an unsupported address family or a port-less layer-4 protocol; the missing sanitization allows the malformed object to be stored and later dereferenced, potentially leading to crashes or policy bypass.

How to fix it

Apply the upstream fix that enforces the NFPROTO_{IPV4,IPV6,INET} and port-bearing L4 protocol restrictions; upgrade chromium (Debian:11) to 87.0.4280.88-0.1, chromium (Debian:12) to 87.0.4280.88-0.1, chromium (Debian:13) to 87.0.4280.88-0.1, and chromium-browser (Ubuntu:16.04:LTS) to 85.0.4183.83-0ubuntu0.16.04.2.

How to confirm the fix worked

Confirm the running kernel contains the sanitization commit; attempt to load test nftables rules using disallowed families or port-less protocols and verify they are rejected; inspect nft list ruleset output for absence of malformed expectations.

Typical attack path

1. Obtain local or remote ability to install nftables rules on a vulnerable Linux kernel
2. Craft an nftables configuration containing a custom ct expectation with an invalid NFPROTO family or non-port L4 protocol
3. Load the configuration via nft or libnftnl
4. Trigger expectation creation or lookup through network traffic that matches the malformed object

How to detect it

Review nftables logs and kernel audit records for attempts to create ct expectations with unexpected protocol families or missing port attributes; correlate with process execution of nft or libnftnl clients.

What your security team should do

• Prioritize kernel updates on all Linux systems that use nftables connection tracking
• Audit existing nftables rule sets for any custom ct expectations that specify non-standard families or L4 protocols
• Monitor EPSS trend (currently flat at 0.0024) and threat-actor activity for any change in exploitation likelihood
• Test patched kernels in a staging environment before broad deployment