What is the CVSS score of CVE-2024-35898?

CVE-2024-35898 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Linux Kernel are affected by CVE-2024-35898?

CVE-2024-35898 is a high-severity race condition in the Linux kernel netfilter subsystem affecting all systems running vulnerable kernel versions, with potential for kernel memory corruption.. A patch is available.

How to fix or mitigate CVE-2024-35898?

Within 24 hours, inventory all systems running vulnerable Linux kernel versions affected by this netfilter nf_tables flowtable race condition using asset management and configuration data. Within 7 days, obtain the vendor-released kernel patch, stage it in your change management system, and develop a prioritized patching schedule focusing first on internet-facing and critical infrastructure systems. Within 30 days, complete patch deployment across all affected systems through standard change control procedures and verify kernel version compliance post-deployment.

Linux Kernel CVE-2024-35898

HIGH

Race Condition (CWE-362)

2024-05-19 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux Race Condition Debian Debian Linux

7.0

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local-only access with low privilege required; AC:H reflects race window timing dependency; full C/I/A impact for potential kernel memory corruption via dangling pointer.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 12:32 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 12:31 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 12:30 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 11:23 NVD

MEDIUM HIGH

CVSS changed

Aug 04, 2026 - 11:23 NVD

5.5 (MEDIUM) 7.0 (HIGH)

CVE Published

May 19, 2024 - 09:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()

nft_unregister_flowtable_type() within nf_flow_inet_module_exit() can concurrent with __nft_flowtable_type_get() within nf_tables_newflowtable(). And thhere is not any protection when iterate over nf_tables_flowtables list in __nft_flowtable_type_get(). Therefore, there is pertential data-race of nf_tables_flowtables list entry.

Use list_for_each_entry_rcu() to iterate over nf_tables_flowtables list in __nft_flowtable_type_get(), and use rcu_read_lock() in the caller nft_flowtable_type_get() to protect the entire type query process.

AnalysisAI

Race condition in the Linux kernel's netfilter nf_tables flowtable subsystem exposes systems to potential kernel memory corruption via an unprotected concurrent list traversal. The __nft_flowtable_type_get() function iterates the nf_tables_flowtables list without RCU synchronization, allowing a collision with nft_unregister_flowtable_type() executing during module exit. Despite a CVSS score of 7.0 (High) with full C/I/A impact, no public exploit identified at time of analysis and an EPSS of 0.01% (1st percentile) indicate this is a maintenance priority rather than an active threat requiring emergency response.

Technical ContextAI

This vulnerability exists within the Linux kernel's netfilter nf_tables subsystem, specifically the flowtable type lookup path. Netfilter is the kernel's core packet filtering framework; nf_tables is its modern rule engine, and flowtables provide hardware or software offload of established connection flows. The root cause, classified as CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization), is that __nft_flowtable_type_get() uses a plain list_for_each_entry() to iterate the nf_tables_flowtables linked list with no RCU read-side lock. Concurrently, nft_unregister_flowtable_type() - called during nf_flow_inet_module_exit() - can modify that same list, creating a classic TOCTOU data race. The fix replaces the iteration with list_for_each_entry_rcu() and adds rcu_read_lock()/rcu_read_unlock() in the caller nft_flowtable_type_get(), applying standard kernel RCU discipline. CPE data confirms the affected product as cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* across multiple version branches including 6.9-rc1 and 6.9-rc2, along with Debian Linux 10.0.

RemediationAI

Apply the upstream kernel patches backported to multiple stable trees, referenced at https://git.kernel.org/stable/c/24225011d81b471acc0e1e315b7d9905459a6304 and the seven additional commits listed in the NVD references. Debian users running kernel packages for Debian 10.0 (Buster) should apply available distribution security updates via apt-get upgrade. Exact patched release versions per stable branch are not confirmed beyond the commit hashes; verify with your distribution's security tracker. As a compensating control where immediate patching is infeasible, disabling nf_tables flowtable offload by avoiding nft add flowtable rules or unloading the nft_flow_offload module (modprobe -r nft_flow_offload) eliminates the vulnerable code path at the cost of disabling connection offload performance optimization. Restricting unprivileged user access to CAP_NET_ADMIN (which governs netfilter configuration) provides a further barrier, though this is typically already enforced in well-hardened environments.