CVE-2024-26808

What it actually does

Use-after-free in netfilter nft_chain_filter due to failure to remove netdevice references from inet/ingress basechain hook lists on NETDEV_UNREGISTER events, leaving stale pointers.

Why it matters to the business

Linux systems may experience kernel instability, crashes, or potential privilege escalation affecting network security controls and overall host reliability; high ecosystem prevalence increases patch urgency across servers and appliances.

How an attack unfolds

An attacker with local or network-adjacent access registers a netdevice hook in an inet/ingress chain then triggers device unregistration, causing subsequent operations to dereference the freed netdevice structure.

How to fix it

Update the Linux kernel to a version containing commit 9489e214ea8f2a90345516016aa51f2db3a8cc2f or later; rebuild and reboot affected systems.

How to confirm the fix worked

Verify kernel source contains the referenced commit or confirm running kernel version is newer than the vulnerable range; test netdevice register/unregister cycles with nft inet/ingress chains.

Typical attack path

1. Obtain local access or ability to influence network device lifecycle on target Linux host
2. Install or trigger creation of nft inet/ingress basechain with netdevice hook
3. Cause or wait for NETDEV_UNREGISTER event for the hooked device
4. Perform follow-on operations that dereference the stale hook entry to trigger use-after-free

How to detect it

Review kernel logs for oops/panic traces involving nft_chain_filter or netdevice hooks around device unregister events; correlate with nftables configuration changes.

What your security team should do

• Prioritize kernel upgrades on internet-facing and multi-tenant systems within 30 days
• Monitor for related kernel privilege-escalation activity from listed threat actors
• Apply defense-in-depth by restricting unprivileged nftables usage where possible