CVE-2024-41042

What it actually does

The vulnerability allows unbounded recursion in nft_validate_register_store during nftables ruleset validation, causing a kernel stack overflow crash instead of proper loop detection.

Why it matters to the business

Systems using nftables may experience unexpected kernel crashes and reboots when loading rulesets, resulting in service outages on Linux-based servers and network devices with high ecosystem prevalence.

How an attack unfolds

An attacker supplies a crafted nftables ruleset containing structures that trigger the flawed register store validation path; during transaction commit the kernel enters unbounded recursion and crashes before any map or chain processing completes. Threat actor campaigns targeting Linux kernel resource and bounds issues have been observed exploiting similar kernel flaws.

How to fix it

Upgrade the Linux kernel to a version containing commit 1947e4c3346faa8ac7e343652c0fd3b3e394202f; rebuild and reboot with the fixed kernel. Remove or disable nftables if immediate patching is not possible.

How to confirm the fix worked

Verify the running kernel contains commit 1947e4c3346faa8ac7e343652c0fd3b3e394202f or later; attempt to load previously crashing rulesets and confirm absence of stack overflow oops messages.

Typical attack path

1. Identify or gain ability to load nftables rulesets on target
2. Construct ruleset that exercises register store validation during loop checks
3. Invoke nft command or equivalent to commit the transaction
4. Trigger stack guard page fault leading to kernel panic

How to detect it

Search kernel logs for stack guard page hits and oops messages mentioning nft or nft_validate_register_store during ruleset loading; correlate with nft command execution timestamps.

• BUG: TASK stack guard page was hit
• Oops: stack guard page
• nft_validate_register_store
• CPU:.*Comm: nft

What your security team should do

• Apply the fixed kernel commit immediately on all affected systems
• Audit nftables rulesets for complex map and chain usage
• Monitor for kernel oops events related to nftables validation
• Prioritize upgrades on internet-facing or critical infrastructure hosts