CVE-2024-56638

What it actually does

Race condition in netfilter nft_inner percpu area for inner header offsets where softirq can interrupt process-context packet walking, leading to invalid state restoration or corrupted skbuff references without proper cookie and flag validation.

Why it matters to the business

Potential kernel crashes or instability during network packet processing on Linux systems using netfilter, particularly with tunnel protocols; low urgency given no KEV listing, low EPSS, and no ransomware use, though high ecosystem prevalence in Linux distributions amplifies patching needs across servers and containers.

How an attack unfolds

An attacker sends specially crafted network packets that engage inner header parsing in nft_inner; a softirq interrupt during percpu offset walking allows the attacker to trigger mismatched skbuff or tunnel type state, potentially leading to invalid memory access or use-after-free in the kernel network stack. No named threat actors are associated with this specific CVE.

How to fix it

Upgrade the Linux kernel to the fixed commit 53c7314208c865086d78b4e88da53bc33da0b603 or later stable release containing the bh-disable and three-check validation logic for percpu inner header handling.

How to confirm the fix worked

Verify the running kernel contains commit 53c7314208c865086d78b4e88da53bc33da0b603 via git log or version string; test with packet workloads that exercise nft_inner tunnel parsing to confirm no crashes occur under softirq contention.

Typical attack path

1. Send packets triggering NFT_PKTINFO_INNER_FULL parsing in process context
2. Softirq interrupts and overwrites percpu area before validation
3. Process context restores stale percpu offsets without cookie or flag checks
4. Kernel performs inner header operations on invalid state resulting in crash or memory corruption

How to detect it

Monitor kernel logs for oops or panic messages referencing nft_inner, percpu areas, or netfilter during packet processing; inspect for unexpected softirq-related crashes on systems with active nftables tunnel rules.

What your security team should do

• Apply the kernel fix immediately on all systems running affected netfilter configurations
• Prioritize patching in environments with high network tunnel traffic or container workloads
• Monitor kernel update channels for backports to distribution kernels
• Review netfilter rulesets to minimize unnecessary inner header inspection until patched