CVE-2024-56655

What it actually does

Race condition during nf_tables rule and chain destruction: nf_tables_chain_destroy and nft_rule_expr_deactivate may sleep or modify shared use counters without proper transaction mutex or synchronize_rcu serialization, allowing concurrent dataplane access or workqueue execution to dereference freed objects.

Why it matters to the business

Kernel networking stack can panic or log warnings under load when nftables rules are added or removed, causing brief loss of network filtering, container isolation, or firewall policy enforcement on affected Linux systems.

How an attack unfolds

An attacker with local or container privileges loads or modifies nftables rules that trigger chain destruction paths; the missing synchronize_rcu allows a concurrent packet or dump operation to reach a partially freed rule or set, surfacing as a warning in nft_set_destroy during the nf_tables_trans_destroy_work workqueue item.

How to fix it

Upgrade the Linux kernel to a fixed version containing commit 5146c27b2780aac59876a887a5f4e793b8949862 or later stable releases (e.g., 6.6.67 or newer). Rebuild and reboot any systems using custom kernels or distributions that have not yet incorporated the patch.

How to confirm the fix worked

Confirm the running kernel contains commit 5146c27b2780 or is at least version 6.6.67; attempt to add and immediately delete nftables rules while monitoring dmesg for the former nft_set_destroy warning; verify lockdep assertions are present in the nf_tables code paths.

Typical attack path

1. Obtain local execution context (user, container, or unprivileged namespace)
2. Create or delete nftables chains/rules that reference other sets or chains
3. Trigger concurrent packet processing or netlink dumps while destruction is deferred via call_rcu
4. Observe kernel warning or crash in nf_tables_trans_destroy_work

How to detect it

Search kernel logs (dmesg, journalctl) for "nft_set_destroy" and "nf_tables_trans_destroy_work" call traces; inspect audit logs for frequent nftables netlink operations around the time of any warning.

What your security team should do

• Prioritize kernel upgrades on all systems that use nftables within the next maintenance window
• Monitor vendor advisories for backported fixes in distribution kernels
• Restrict unprivileged users from loading nftables modules until patched
• Add kernel version checks to existing configuration management and vulnerability scanning