CVE-2024-46855

What it actually does

Missing sk reference count decrement in nft_socket before return creates a use-after-free condition allowing access to a freed socket object in the Linux kernel netfilter subsystem.

Why it matters to the business

Linux systems may experience kernel instability, crashes, or local privilege escalation, increasing risk of service disruption and unauthorized access especially in environments with high downstream kernel usage.

How an attack unfolds

An attacker with local access crafts nftables rules that invoke nft_socket to trigger the reference count leak, then reuses the freed sk object to corrupt kernel memory or execute code.

How to fix it

Update the Linux kernel to the fixed commit 076d281e90aaf4192799ecb9a1ed82321e133ecd or later stable releases; rebuild and reboot with the patched kernel image.

How to confirm the fix worked

Verify kernel source contains commit 076d281e90aaf4192799ecb9a1ed82321e133ecd or confirm running kernel version includes the nft_socket reference count fix via git log or package changelog.

Typical attack path

1. Obtain local access on a vulnerable Linux system
2. Load or modify nftables configuration to exercise nft_socket path
3. Trigger repeated allocation and return without put to leak references
4. Reuse freed socket structure for memory corruption or escalation
5. Execute payload or cause denial of service

How to detect it

Review system logs for netfilter or nftables related kernel warnings, oops, or use-after-free traces; inspect audit logs for unusual nftables rule additions or socket operations preceding crashes.

What your security team should do

• Apply the referenced kernel commit or distribution update immediately on all affected systems
• Audit nftables rulesets for unnecessary socket lookups
• Monitor for kernel oops or panic logs related to netfilter
• Prioritize patching on multi-tenant or exposed hosts given kernel prevalence