CVE-2024-26910

What it actually does

Unnecessary synchronize_rcu() call added to ipset swap function causes performance regression; the call should have been moved to destroy and converted to call_rcu() while splitting destroy to safely cancel timeout garbage collectors.

Why it matters to the business

Reduced throughput and increased latency for network packet filtering and IP set management on Linux hosts, affecting high-volume network security controls and increasing operational overhead until patched.

How an attack unfolds

Local user triggers repeated ipset swap commands via netlink; the blocking RCU synchronization in the swap path creates contention and slowdown, amplifying availability impact under load.

How to fix it

Upgrade the Linux kernel to a fixed version such as 5.4.269 or later commits including c7f2733e5011bfd136f1ca93497394d43aa76225; rebuild and reboot with the updated kernel.

How to confirm the fix worked

Confirm running kernel contains the fix commit or version 5.4.269+; benchmark ipset swap latency before and after the update to verify performance restoration.

Typical attack path

1. Obtain local user access on a Linux system using ipset
2. Issue netlink commands that invoke the ipset swap operation
3. Trigger or observe the resulting performance degradation in netfilter processing

How to detect it

Review kernel logs and performance counters for ipset swap latency spikes; correlate with netlink process activity and high CPU in netfilter paths on unpatched kernels.

What your security team should do

• Prioritize kernel upgrades on systems with heavy ipset or netfilter usage
• Test ipset swap performance in staging environments after patching
• Monitor kernel changelogs for related RCU and ipset changes in future releases