CVE-2024-27064

What it actually does

Failure to free nft_stats memory allocated before nft_netdev_register_hooks in nf_tables_updchain when the hook registration fails, leaving the allocation orphaned.

Why it matters to the business

Gradual memory exhaustion on Linux systems using netfilter can degrade performance, trigger OOM conditions, or force unplanned reboots, increasing operational overhead for network-heavy workloads; the issue has been public for over two years with no known exploitation or ransomware use.

How an attack unfolds

An attacker would craft netfilter chain updates that force nft_netdev_register_hooks to fail after nft_stats_alloc has already succeeded; repeated triggers accumulate leaked kernel memory, but no threat actors or campaigns have been observed exploiting this path.

How to fix it

Upgrade the Linux kernel to a version containing commit 6995e2de6891c724bfeb2db33d7b87775f913ad1; rebuild and deploy the updated kernel or apply the corresponding distribution package.

How to confirm the fix worked

Confirm the commit hash is present in the running kernel source tree or verify the fixed package version; test nft chain updates that previously triggered the leak path and monitor for continued memory growth.

Typical attack path

1. Obtain privileges or access sufficient to modify nf_tables chains
2. Trigger chain updates that cause nft_netdev_register_hooks to return an error
3. Repeat the failing update path to accumulate unreleased nft_stats allocations

How to detect it

Examine kernel logs for nf_tables errors around chain updates, track slab or kmalloc growth tied to nft_stats structures, and correlate with netfilter configuration changes.

What your security team should do

• Apply the kernel fix to all affected systems as soon as possible
• Review netfilter configurations that rely on netdev hooks for unnecessary complexity
• Include kernel memory usage metrics for nf_tables in routine monitoring