CVE-2024-26809

What it actually does

Use-after-free in nft_set_pipapo element release during clone operations in netfilter, allowing double destruction of set elements from incorrect paths instead of only destroy.

Why it matters to the business

Kernel instability or crashes on Linux systems using nftables pipapo sets, potentially causing denial of service; low risk of escalation given local-only vector and low exploit maturity.

How an attack unfolds

Local attacker loads crafted nftables rules that exercise pipapo set cloning during commit/abort to trigger double element release, resulting in use-after-free memory corruption.

How to fix it

Upgrade to fixed kernel versions including 5.10.214 or apply commit b36b83297ff4910dfc8705402c8abffd4bbf8144 from the stable Linux git repository.

How to confirm the fix worked

Confirm running kernel version matches or exceeds fixed releases and verify the referenced commit is present in the kernel source tree.

Typical attack path

1. Gain local user access on affected Linux kernel
2. Install or trigger nftables configuration using pipapo sets
3. Force operations that invoke set clone and destroy paths concurrently
4. Trigger use-after-free for crash or limited corruption

How to detect it

Inspect dmesg and kernel logs for oops, warnings, or double-free messages referencing nft_set_pipapo or nf_tables commit paths.

What your security team should do

• Prioritize kernel package updates across all Linux hosts
• Test nftables workloads post-upgrade for stability
• Limit unprivileged nftables access via capabilities or namespaces where feasible