Linux Kernel
CVE-2024-26808
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector confirmed; PR:L reflects low-privilege local access sufficient to trigger network device events, with full kernel-level impact if exploited.
Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).
CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
Remove netdevice from inet/ingress basechain in case NETDEV_UNREGISTER event is reported, otherwise a stale reference to netdevice remains in the hook list.
AnalysisAI
Stale netdevice pointer in Linux kernel netfilter's nft_chain_filter subsystem allows a local low-privileged attacker to trigger a use-after-free condition by unregistering a network device while an inet/ingress nftables basechain remains attached, potentially leading to kernel memory corruption, privilege escalation, or system crash. Affected systems include the Linux kernel across multiple stable branches and Debian Linux 10.0 (Buster LTS). No public exploit code has been identified at time of analysis, and EPSS at 0.24% (16th percentile) indicates low real-world exploitation activity despite the high CVSS score.
Technical ContextAI
The vulnerability resides in the Linux kernel's netfilter framework, specifically within the nft_chain_filter module (net/netfilter/nft_chain_filter.c). When a network device is unregistered, the kernel emits a NETDEV_UNREGISTER notification. The affected code path failed to handle this event for inet/ingress basechains - network hook chains that attach directly to a network interface. When the device is unregistered and its memory freed, the corresponding nftables hook entry still holds a raw pointer to the now-freed netdevice structure. Any subsequent kernel operation traversing that hook list (e.g., during packet processing or chain enumeration) would dereference this stale pointer, a classic use-after-free pattern classified as a memory safety violation. CPE data confirms the vulnerability spans the Linux kernel broadly (cpe:2.3:o:linux:linux_kernel:*) including the 6.8-rc1 development milestone, with Debian Linux 10.0 also explicitly identified as an affected distribution.
RemediationAI
Upstream patches are confirmed available via six stable-tree commits: the primary fixes are at https://git.kernel.org/stable/c/01acb2e8666a6529697141a6017edbf206921913, https://git.kernel.org/stable/c/36a0a80f32209238469deb481967d777a3d539ee, https://git.kernel.org/stable/c/70f17b48c86622217a58d5099d29242fc9adac58, https://git.kernel.org/stable/c/9489e214ea8f2a90345516016aa51f2db3a8cc2f, https://git.kernel.org/stable/c/af149a46890e8285d1618bd68b8d159bdb87fdb3, and https://git.kernel.org/stable/c/e5888acbf1a3d8d021990ce6c6061fd5b2bb21b4. The exact patched release versions are not independently confirmed from available data - specific version numbers should be verified against the distribution's changelog. Debian LTS users should apply the kernel update announced at https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html. As a compensating control where patching is not immediately feasible, avoiding the use of nftables inet/ingress basechains attached to physical or virtual network interfaces eliminates the vulnerable code path; however, this may impact firewall functionality and should be evaluated against operational requirements. Restricting local user access and disabling user namespaces (sysctl -w kernel.unprivileged_userns_clone=0 on supported distributions) reduces the reachable attack surface.
More in Debian Linux
View allApache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) o
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. Rated critical severity (
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today