CVE-2024-26834

What it actually does

Memory leak of dst objects allocated via rt_dst_alloc when nft_flow_offload uses the direct xmit path, because dst_release is not called after dev_queue_xmit.

Why it matters to the business

Long-running systems using nftables flow offload can gradually exhaust kernel memory, causing performance degradation, reduced capacity, or eventual crashes under sustained traffic.

How an attack unfolds

An attacker configures nftables rules that activate nft_flow_offload, then sends traffic that triggers the direct transmit path repeatedly, causing repeated dst allocations without corresponding releases and gradual memory exhaustion.

How to fix it

Upgrade the Linux kernel to a version containing commit 13b57b5cd591d5b22f9bbf047b2922967de411f3 which adds the missing dst_release call in the direct xmit path of nft_flow_offload.

How to confirm the fix worked

Verify the running kernel contains commit 13b57b5cd591d5b22f9bbf047b2922967de411f3 or later; reproduce traffic matching offload rules and confirm absence of new kmemleak reports for dst objects from nft_flow_route.

Typical attack path

1. Install or trigger nftables rules that load the nft_flow_offload module and enable flow offload.
2. Generate network traffic that matches the offload rules and forces the direct xmit code path.
3. Repeat the traffic pattern over time to accumulate unreleased dst allocations reported by kmemleak.
4. Monitor for system memory pressure or kmemleak warnings as the leak manifests.

How to detect it

Search kernel logs and kmemleak output for backtraces containing nft_flow_route, nft_flow_offload_eval, dst_alloc, and rt_dst_alloc; inspect for unreferenced dst objects allocated during softirq context with nftables chains active.

• unreferenced object.*dst_alloc
• backtrace.*nft_flow_route
• backtrace.*nft_flow_offload_eval
• comm "softirq".*dst_alloc

What your security team should do

• Prioritize kernel upgrades on systems that actively use nftables flow offload features.
• Enable kmemleak or similar kernel memory debugging on representative systems to detect leaks early.
• Review nftables configurations and disable flow offload where not strictly required until patched.
• Monitor EPSS and KEV updates for any change in exploit maturity.