CVE-2024-35900

What it actually does

Race condition in nf_tables allows adding a new base chain after toggling the dormant table flag, resulting in an inconsistent hook state that triggers double unregistration and a kernel warning during commit or disable operations.

Why it matters to the business

Local users can trigger kernel warnings or crashes on systems using nftables for firewall rules, causing denial of service and potential system instability in environments that dynamically manage tables and chains.

How an attack unfolds

An attacker with local privileges issues a sequence of nftables commands to create a table and chain, set the table dormant, then add another chain before the commit phase; this leaves a hook registered inconsistently so that later disable attempts cause the kernel to warn or panic when attempting to unregister an already-unregistered hook.

How to fix it

Upgrade the Linux kernel to a fixed version such as 5.4.274 or apply the commit 6d12f21f8bbe23fde25b77c2bf5973c136b8bef8; rebuild and reboot systems with the patched kernel; avoid dynamic dormant flag toggling combined with new chain additions until patched.

How to confirm the fix worked

Verify the running kernel version contains the fix commit or is at least 5.4.274; attempt to reproduce the original nftables sequence and confirm no warning is emitted in dmesg; review netfilter commit logs for the referenced change.

Typical attack path

1. Add a table and an initial base chain with a hook
2. Toggle the table's dormant flag
3. Add a second base chain with a different priority hook
4. Trigger the commit phase or table disable operation
5. Observe the double-unregister warning or crash in netfilter core

How to detect it

Search kernel logs and dmesg for the __nf_unregister_net_hook warning and stack traces referencing nf_tables_commit or nft_table_disable; correlate with nftables command history showing table flag changes followed by new chain additions.

• WARNING: CPU:.*__nf_unregister_net_hook
• nft_table_disable
• nf_tables_commit

What your security team should do

• Apply the kernel update to all affected systems within the next maintenance window
• Restrict unprivileged local access to nftables commands until patched
• Monitor dmesg and kernel logs for __nf_unregister_net_hook warnings
• Test nftables configurations in a lab environment before production rollout