CVE-2024-26924: Linux Kernel Use-After-Free Vulnerability

CVE-2024-26924 Overview

CVE-2024-26924 is a use-after-free vulnerability in the Linux kernel's netfilter subsystem, specifically in the nft_set_pipapo element removal logic. The flaw stems from incorrect handling of duplicate keys during back-to-back add and remove operations on large element batches. When multiple elements share the same key, the nft_pipapo_remove() function can unmap the wrong element, leaving a stale pointer reachable through subsequent set lookups. A local user with the CAP_NET_ADMIN capability can trigger the condition to cause kernel memory corruption. The vulnerability affects Linux kernel versions through 6.9-rc4 and multiple Debian and Fedora distributions.

Critical Impact
Local attackers with network namespace privileges can trigger kernel memory corruption, leading to denial of service or potential local privilege escalation on affected Linux systems.

Affected Products

Linux Kernel (multiple versions through 6.9-rc4)
Debian Linux 10.0
Fedora distributions (multiple releases)

Discovery Timeline

2024-04-25 - CVE-2024-26924 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2024-26924

Vulnerability Analysis

The vulnerability resides in the pipapo (PIle PAcket POlicies) set backend used by nftables for efficient concurrent packet classification. Element removal happens in two phases: a lookup phase marks the element inactive in the next generation, and a subsequent phase unmaps the element from the set data structure. The _remove function fails to correctly handle the case where multiple elements share the same key.

Duplicate keys arise when an element is inserted while an existing element with the same key has timed out or is inactive in the next generation. In this scenario, the two-phase removal can deactivate one element but unmap another. The non-deactivated element becomes unreachable and leaks, while the deactivated element remains reachable in the set structure. Subsequent lookups dereference the stale pointer, producing a kernel crash detected by KASAN.

Root Cause

The root cause is a logic error [CWE-476] in the pipapo removal path that does not verify the matched key actually maps to the element previously marked inactive. Without this verification, the wrong element is removed from the mapping structure, breaking the invariant between set membership and element reachability.

Attack Vector

Exploitation requires local access with the CAP_NET_ADMIN capability, which can be held within an unprivileged user namespace on many distributions. An attacker submits large batches of nftables set operations that repeatedly add and delete elements with short timeouts, engineering collisions where multiple elements briefly share the same key. Triggering the removal path against such collisions leads to use-after-free conditions on kernel objects reachable through subsequent packet processing or set lookups.

The upstream fix adds a verification check that the fully matching key maps to the element marked inactive during deactivation. If the mapping does not match, the search continues. A WARN/BUG trap is added at the end of the function to catch invalid invocations against unreachable elements. See the patch commits 14b001ba, 3cfc9ec0, 41d8fdf3, 7a1679e2, e3b887a9, and ebf7c974 for reference.

Detection Methods for CVE-2024-26924

Indicators of Compromise

KASAN splats in kernel logs referencing nft_pipapo_remove or pipapo_get functions.
Unexpected kernel oopses or panics during nftables ruleset updates involving set elements with timeouts.
Processes with CAP_NET_ADMIN executing high-frequency nft batch operations combining add element and delete element commands.

Detection Strategies

Enable KASAN on test kernels to identify use-after-free conditions triggered by netfilter set churn.
Audit nft and nftables-related syscalls (NFT_MSG_NEWSETELEM, NFT_MSG_DELSETELEM) via auditd for abnormal volume from non-administrative processes.
Correlate kernel ring buffer messages (dmesg) with EDR telemetry on the originating user and container context.

Monitoring Recommendations

Monitor /var/log/kern.log and journalctl -k for warnings originating in net/netfilter/nft_set_pipapo.c.
Track user namespace creation combined with subsequent nftables set manipulation as a suspicious pattern.
Alert on kernel taint flags or WARN_ON traps introduced by the fix, indicating attempted exploitation.

How to Mitigate CVE-2024-26924

Immediate Actions Required

Apply the latest stable Linux kernel updates from your distribution vendor that include the netfilter pipapo fix.
Inventory hosts running vulnerable kernel versions using tools such as uname -r combined with distribution package metadata.
Restrict unprivileged user namespace creation on production hosts where it is not required.

Patch Information

The fix is available in upstream stable trees via commits 14b001ba221136c15f894577253e8db535b99487, 3cfc9ec039af60dbd8965ae085b2c2ccdcfbe1cc, 41d8fdf3afaff312e17466e4ab732937738d5644, 7a1679e2d9bfa3b5f8755c2c7113e54b7d42bd46, e3b887a9c11caf8357a821260e095f2a694a34f2, and ebf7c9746f073035ee26209e38c3a1170f7b349a. Distribution updates are available via the Debian LTS Security Announcement and multiple Fedora package announcements.

Workarounds

Disable unprivileged user namespaces where feasible by setting kernel.unprivileged_userns_clone=0 via sysctl.
Restrict CAP_NET_ADMIN to trusted administrators and audit container runtimes that grant it by default.
Limit nftables set usage patterns that combine short timeouts with high-frequency add/delete batches until patches are deployed.

bash

# Disable unprivileged user namespaces to reduce local attack surface
sudo sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-hardening.conf

# Verify current kernel version against vendor advisories
uname -r