CVE-2024-27020

What it actually does

Data race during concurrent access to the nf_tables_expressions list in __nft_expr_type_get() allows unprotected iteration while nft_unregister_expr() modifies the list, leading to inconsistent kernel state or memory corruption in the netfilter subsystem.

Why it matters to the business

Local attackers on affected Linux systems could trigger kernel crashes or privilege escalation, disrupting network services, containers, and servers; the issue affects widely used kernel versions but carries low immediate risk due to stable low exploit probability and lack of known campaigns.

How an attack unfolds

An attacker with local access loads or unloads netfilter expression modules while simultaneously triggering type queries, racing the list iteration to corrupt kernel data structures; the race is difficult to win reliably and no public exploits or specific threat actor campaigns are associated with this flaw.

How to fix it

Upgrade the Linux kernel to a version containing commit 939109c0a8e2a006a6cc8209e262d25065f4403a or later stable releases that apply RCU-protected list iteration and locking around expression type queries.

How to confirm the fix worked

Verify the running kernel includes the referenced commit or is newer than the affected branches; inspect netfilter source for use of list_for_each_entry_rcu() and rcu_read_lock() in nft_expr_type_get().

Typical attack path

1. Obtain local code execution on a vulnerable Linux host
2. Register and unregister custom nft expressions in rapid succession
3. Trigger concurrent nft_expr_type_get() calls from user-space netfilter operations
4. Exploit resulting memory inconsistency for denial of service or privilege escalation

How to detect it

Exploitation attempts would appear as unusual patterns of netfilter module load/unload coinciding with nftables operations; review kernel logs for oops or warnings around nf_tables and audit local processes interacting with netfilter.

What your security team should do

• Apply the fixed kernel commit or distribution update as soon as practical
• Monitor for future Linux kernel updates addressing netfilter races
• Limit untrusted local code execution on systems handling network filtering