CVE-2024-35898

What it actually does

Data race in __nft_flowtable_type_get() during concurrent access and modification of the nf_tables_flowtables list without RCU protection, allowing unsynchronized iteration that can corrupt list state and trigger kernel instability.

Why it matters to the business

Local users on affected Linux systems may trigger kernel crashes or denial of service in network filtering, disrupting network-dependent services and requiring reboots or maintenance windows; widespread exposure across Linux distributions increases operational risk until kernels are updated.

How an attack unfolds

An attacker with local access concurrently invokes nft_unregister_flowtable_type during module exit while nf_tables_newflowtable performs a type query, racing on the unprotected list traversal to induce list corruption or use-after-free conditions that manifest as crashes.

How to fix it

Upgrade the Linux kernel to a version containing commit 69d1fe14a680042ec913f22196b58e2c8ff1b007 which replaces the list traversal with list_for_each_entry_rcu and adds rcu_read_lock protection in nft_flowtable_type_get.

How to confirm the fix worked

Confirm the running kernel source includes the RCU-protected list iteration in __nft_flowtable_type_get and rcu_read_lock in nft_flowtable_type_get; test by exercising concurrent flowtable creation and module unload paths under stress.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Trigger concurrent flowtable registration and module unload operations via user-space netfilter tools or scripts
3. Cause unsynchronized list iteration leading to kernel memory corruption or panic

How to detect it

Review kernel logs for oops, BUG, or warning messages referencing nf_tables_flowtables or __nft_flowtable_type_get during module unload or flowtable operations; examine audit logs for unusual concurrent netfilter configuration activity.

What your security team should do

• Apply the referenced kernel commit or distribution backport immediately on all exposed systems
• Restrict unprivileged local access where feasible until patched
• Monitor for kernel oops or nf_tables related panics in system logs