CVE-2024-42269

What it actually does

Null pointer dereference in ip6table_nat_table_init due to net->gen->ptr access before register_pernet_subsys allocates the pernet entry, exposed via xt_register_template ordering.

Why it matters to the business

Local denial of service on Linux systems performing IPv6 NAT, potentially crashing the kernel during network namespace or table initialization; moderate impact given low EPSS and lack of known in-the-wild exploitation despite 9 downstream dependents.

How an attack unfolds

An attacker with local access triggers iptables IPv6 NAT table initialization before the pernet subsystem registration completes, causing the kernel to dereference an unallocated pointer and crash; no named threat actors are confirmed exploiting this specific flaw.

How to fix it

Update the Linux kernel to a version containing commit 419ee6274c5153b89c4393c1946faa4c3cad4f9e or later; rebuild and reboot with the patched kernel; verify pernet registration ordering in netfilter/iptables code.

How to confirm the fix worked

Confirm kernel version includes the referenced commit; test IPv6 NAT table initialization under multiple network namespaces; monitor for absence of null pointer dereference oops in dmesg during xt_register_template calls.

Typical attack path

1. Obtain local user access on affected Linux kernel
2. Invoke ip6table_nat operations or load relevant netfilter modules
3. Trigger net namespace or table init before register_pernet_subsys completes
4. Cause null pointer dereference leading to kernel panic or oops

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for null pointer dereference oops involving ip6table_nat_table_init or netfilter registration; correlate with user-initiated iptables IPv6 NAT commands.

What your security team should do

• Prioritize patching production kernels handling IPv6 traffic within standard maintenance windows
• Audit systems for custom netfilter modules that may expose similar registration ordering issues
• Enable kernel crash logging and monitoring for netfilter-related oops events