CVE-2024-26642 Overview
CVE-2024-26642 is a Linux kernel vulnerability in the netfilter subsystem, specifically within nf_tables. The kernel previously allowed userspace to create anonymous sets with the timeout flag, a configuration that was never intended to be valid. The fix disallows anonymous sets with the timeout flag, while preserving an exception for NFT_SET_EVAL so legacy meters continue to function. A local user with CAP_NET_ADMIN privileges can trigger the flaw to cause high availability impact on the host. The vulnerability affects multiple stable Linux kernel branches and downstream distributions including Debian.
Critical Impact
Local low-privileged users with networking capability can trigger kernel-level denial of service through malformed nf_tables anonymous set creation requests.
Affected Products
- Linux Kernel (multiple stable branches prior to the patch commits)
- Debian Linux 10.0 (and other distributions tracked via Debian LTS)
- Siemens products referenced in advisory SSA-265688
Discovery Timeline
- 2024-03-21 - CVE-2024-26642 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2024-26642
Vulnerability Analysis
The Linux kernel netfilter framework provides packet filtering and classification through the nf_tables subsystem. Sets in nf_tables store elements such as IP addresses, ports, or interfaces used by rules. Anonymous sets are created inline with a rule and tied to that rule's lifecycle. Named sets, in contrast, are created independently and may carry a timeout flag so elements expire after a configured interval.
The kernel did not enforce that anonymous sets must not carry the NFT_SET_TIMEOUT flag. Userspace tools such as nft never create anonymous sets with timeouts, so the code paths handling that combination were not exercised under normal conditions. When a crafted Netlink message constructs an anonymous set with the timeout flag, the kernel reaches state that the developers did not intend to be reachable, producing a crash or availability impact on the host.
The fix rejects this configuration at set creation time. An exception is retained for NFT_SET_EVAL to preserve compatibility with legacy meters, which historically rely on anonymous sets in evaluation contexts.
Root Cause
The root cause is missing input validation in the nf_tables set creation handler. The combination of anonymous set semantics and timeout-based element expiration was never a supported configuration, but the kernel accepted it from Netlink. Categorized under improper input validation affecting kernel state.
Attack Vector
Exploitation requires local access and the CAP_NET_ADMIN capability, which is typically held by root or processes in user namespaces with network admin rights. On systems where unprivileged user namespaces are enabled, a non-root user can obtain CAP_NET_ADMIN inside a user namespace and reach the vulnerable code path through Netlink. The attacker sends an nf_tables Netlink message that creates a new set with both anonymous and timeout flags set, triggering the unsafe state.
The vulnerability mechanism is described in the upstream commit messages. See the Linux kernel stable commit for the authoritative fix.
Detection Methods for CVE-2024-26642
Indicators of Compromise
- Unexpected kernel oops or panic messages in dmesg referencing nf_tables or nft_set functions
- Sudden host or container reboots correlated with nft Netlink activity from unprivileged processes
- Audit records showing CAP_NET_ADMIN use by processes running inside user namespaces
Detection Strategies
- Monitor auditd for netlink socket creation with NETLINK_NETFILTER from non-administrative users and processes
- Deploy eBPF probes on nf_tables_newset to log set creation requests carrying both NFT_SET_ANONYMOUS and NFT_SET_TIMEOUT flags
- Correlate kernel crash dumps with recent container or user-namespace activity to identify exploitation attempts
Monitoring Recommendations
- Enable kernel crash collection via kdump so post-incident analysis can confirm the faulting function
- Track installed kernel package versions across the fleet and alert on hosts running pre-patch builds
- Watch container runtimes for workloads that request CAP_NET_ADMIN or unshare user namespaces unexpectedly
How to Mitigate CVE-2024-26642
Immediate Actions Required
- Apply the stable kernel update that includes the upstream fix and reboot affected hosts
- On Debian, install the kernel updates referenced in Debian LTS announcement msg00017 and msg00020
- Siemens operators should follow guidance in Siemens Security Advisory SSA-265688
Patch Information
The fix is committed to mainline and backported to multiple stable trees. Reference commits include 72c1efe3f247, 16603605b667, 7cdc1be24cc1, 8e07c1669558, c0c2176d1814, e4988d8415bd, e9a0d3f376eb, and fe40ffbca19d.
Workarounds
- Disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0 where workloads do not require them
- Restrict CAP_NET_ADMIN in container runtimes by dropping the capability from default profiles for untrusted workloads
- Apply seccomp filters that deny NETLINK_NETFILTER socket creation for processes that do not require firewall management
# Configuration example: harden host against local nf_tables abuse
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' >> /etc/sysctl.d/99-hardening.conf
# Drop CAP_NET_ADMIN from a Docker container at runtime
docker run --cap-drop=NET_ADMIN <image>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
