CVE-2024-42109

What it actually does

Use-after-free in nft_ctx_update and nft_commit_release when nf_tables notifier performs conditional workqueue flush, leaving table references accessible to nf_tables_trans_destroy_work kworker.

Why it matters to the business

Kernel instability or potential local privilege escalation on Linux systems using nftables, increasing crash risk and requiring urgent kernel updates across server and appliance fleets.

How an attack unfolds

Attacker crafts nftables transactions that reference a table still queued for destruction; after table removal the pending worker dereferences freed memory, triggering slab UAF during family field access.

How to fix it

Upgrade Linux kernel to 5.15.163 or later stable branches containing commit 3325628cb36b7f216c5716e7b5124d9dc81199e4; rebuild and reboot systems using nftables.

How to confirm the fix worked

Confirm kernel version >= 5.15.163, verify presence of unconditional flush_work call before nf_tables notifier, and test nftables table creation/deletion under load without KASAN splats.

Typical attack path

1. Create nftables tables and rules that generate pending transactions
2. Trigger table deletion while transactions remain in workqueue
3. Force nf_tables notifier path with conditional flush
4. kworker executes nf_tables_trans_destroy_work accessing freed nft_ctx
5. Read of size 2 at freed address causes KASAN-detected UAF

How to detect it

Search kernel logs and dmesg for KASAN slab-uaf reports referencing nft_ctx_update, nft_commit_release, or nf_tables_trans_destroy_work; inspect workqueue events and nftables transaction activity preceding crashes.

• KASAN: slab-uaf in nft_ctx_update
• nf_tables_trans_destroy_work
• Read of size 2 at addr
• Workqueue: events nf_tables_trans_destroy_work

What your security team should do

• Apply kernel updates to 5.15.163 or equivalent immediately on all production systems
• Audit nftables usage and disable unnecessary netfilter rulesets until patched
• Monitor for kernel oops and KASAN reports mentioning nf_tables_trans_destroy_work
• Prioritize patching on internet-facing or multi-tenant hosts first