CVE-2024-26835

What it actually does

Failure to set the dormant flag on hook registration error leaves an nftables table marked active with no hooks registered; subsequent table or chain deletion triggers an erroneous hook unregistration attempt that emits a warn splat in the nftables core.

Why it matters to the business

Under memory pressure, administrators or local processes that create and later delete nftables tables or chains may trigger kernel warnings, reducing system stability and complicating routine network rule management on Linux hosts.

How an attack unfolds

A local user induces memory pressure, creates an nftables table or base chain so that hook registration fails, then deletes the table or chain; the kernel attempts to unregister a non-existent hook and logs a warning.

How to fix it

Upgrade the Linux kernel to a fixed version such as 5.4.270 or the commit a6411f3c48f991c19aaf9a24fce36865fbba28d7 (and equivalent backports) and reboot affected systems.

How to confirm the fix worked

Confirm the installed kernel version is at or above the listed fixed releases; attempt to reproduce the failure scenario under memory pressure and verify no warn splat occurs on table deletion.

Typical attack path

1. Obtain local access on an affected Linux system
2. Create memory pressure to cause hook registration failure
3. Add an nftables table or base chain
4. Delete the table or base chain to trigger the unregistration warning

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for nftables core warning messages related to hook unregistration on table or chain deletion events.

• nftables core warn splat on hook unregistration
• table marked active but no registered hooks

What your security team should do

• Prioritize kernel upgrades on all systems that use nftables
• Monitor for the described warn splat in kernel logs until patches are applied
• Test the fix in a staging environment that can simulate memory pressure before broad deployment