CVE-2024-27403

What it actually does

Double release of dst object in nft_flow_offload error path after dst is transferred to the flow object, causing refcount underflow and potential use-after-free in the Linux kernel netfilter subsystem.

Why it matters to the business

Linux systems performing network address translation or connection tracking may experience kernel instability, crashes, or memory corruption during high-volume or failing flow offload operations, increasing downtime risk for network-heavy workloads.

How an attack unfolds

An attacker sends network traffic that engages nft_flow_offload, arranges for flow_offload_add to fail after the dst transfer, and triggers the double-release path that underflows the refcount, potentially leading to a use-after-free condition.

How to fix it

Upgrade the Linux kernel to a version containing commit 4c167af9f6b5ae4a5dbc243d5983c295ccc2e43c or later; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 4c167af9f6b5ae4a5dbc243d5983c295ccc2e43c via 'uname -r' and git log, or verify the nft_flow_offload source no longer performs the second dst release.

Typical attack path

1. Send crafted packets that match nftables flow-offload rules
2. Force flow_offload_add to return an error after dst ownership transfer
3. Trigger the error path that releases the already-moved dst a second time
4. Exploit the resulting refcount underflow for memory corruption or crash

How to detect it

Review kernel logs for refcount underflow warnings or double-free messages originating from netfilter or nft_flow_offload; correlate with nftables flow-offload rule usage.

What your security team should do

• Prioritize kernel updates on all systems exposing netfilter to untrusted traffic
• Monitor for kernel panics or refcount warnings in dmesg on production gateways
• Temporarily disable flow offload rules if immediate patching is not feasible