CVE-2024-50251

What it actually does

Invalid offset and length values passed to skb_checksum() in netfilter nft_payload exceed skbuff length, triggering internal BUG_ON() after length subtraction during iteration and causing kernel panic.

Why it matters to the business

Local denial-of-service crashes on Linux systems using nftables, leading to unplanned downtime; low EPSS and absence from KEV indicate limited real-world risk despite the 2024 disclosure and listed threat actor interest in similar kernel flaws.

How an attack unfolds

A local attacker supplies a crafted nftables rule or packet that reaches nft_payload with offset + length larger than the skbuff, causing skb_checksum() to fail its final length-consumption check and panic the kernel; listed 2024 espionage and financially motivated campaigns have targeted analogous Linux kernel issues.

How to fix it

Apply the upstream kernel fix that sanitizes offset and length before the skb_checksum() call; for the listed flashplugin-nonfree package on Ubuntu 14.04 LTS update to version 11.2.202.569ubuntu0.14.04.1.

How to confirm the fix worked

Confirm the sanitization patch is present in the running kernel source or binary; test by attempting to load nftables rules that previously supplied oversized offset/length values and verify absence of BUG_ON() panics.

Typical attack path

1. Gain local access on a vulnerable Linux host
2. Install or trigger nftables rules that invoke nft_payload
3. Craft offset and length exceeding actual skbuff data
4. Invoke skb_checksum() to trigger BUG_ON() and kernel panic

How to detect it

Search kernel logs for BUG_ON() messages originating from skb_checksum(), unusual nftables rule loads, or netfilter-related panics; correlate with process activity involving nft or iptables-restore around the time of crashes.

• BUG_ON(len) in skb_checksum
• nft_payload.*offset
• skb_checksum.*skbuff
• netfilter panic

What your security team should do

• Prioritize patching affected Linux kernel packages on all production systems
• Review nftables configurations for any custom payload rules that could supply large offsets
• Monitor EPSS trend and threat actor reports for similar kernel CVEs
• Disable unnecessary nftables features if immediate patching is delayed