CVE-2024-26925: Linux Kernel Race Condition Vulnerability

CVE-2024-26925 Overview

CVE-2024-26925 is a locking flaw in the Linux kernel's netfilter subsystem, specifically in nf_tables. The kernel releases the commit mutex prematurely during the abort path between nft_gc_seq_begin() and nft_gc_seq_end(). This allows the asynchronous garbage collection (GC) worker to operate on expired objects without holding the commit lock within the same GC sequence. The vulnerability is classified as [CWE-667] Improper Locking and affects mainline Linux kernel builds along with Debian Linux distributions.

Critical Impact
A local, low-privileged attacker can trigger the race condition to cause kernel-level denial of service through inconsistent state in the netfilter tables subsystem.

Affected Products

Linux Kernel (multiple branches including 6.5, 6.9-rc1, 6.9-rc2)
Debian Linux 10.0
Siemens products incorporating affected kernel versions (per vendor advisories)

Discovery Timeline

2024-04-25 - CVE-2024-26925 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2024-26925

Vulnerability Analysis

The flaw resides in the netfilter nf_tables transaction abort path. During normal operation, nft_gc_seq_begin() and nft_gc_seq_end() define a critical section that protects the asynchronous GC worker from racing with transaction processing. The commit mutex must remain held throughout this section to maintain consistency.

The function nf_tables_module_autoload() temporarily releases the commit mutex to load module dependencies, then replays the transaction. When called inside the critical section, this premature release allows the async GC worker to collect expired objects while the lock is unheld within the same GC sequence. The result is inconsistent kernel state in the netfilter tables, leading to potential memory corruption or kernel panic.

Root Cause

The root cause is improper lock management ([CWE-667]) in the abort path of nf_tables. nf_tables_module_autoload() was invoked while the GC sequence was still active, breaking the invariant that the commit mutex remains held between nft_gc_seq_begin() and nft_gc_seq_end(). The fix moves the autoload call to the end of the abort phase, after nft_gc_seq_end() completes.

Attack Vector

Exploitation requires local access with low privileges, specifically the CAP_NET_ADMIN capability within a user or network namespace. Unprivileged users on systems with user namespaces enabled can craft nf_tables transactions that trigger the abort path and force module autoloading. Repeated triggering races the async GC worker against the unlocked critical section, producing kernel instability and denial of service.

No verified public exploit code is available. The vulnerability mechanism is documented in the upstream kernel commits referenced in the Kernel Git Commit Change.

Detection Methods for CVE-2024-26925

Indicators of Compromise

Unexpected kernel oops or panic messages referencing nf_tables, nft_gc_seq_end, or nf_tables_module_autoload in dmesg or /var/log/kern.log
System instability or crashes correlated with nftables rule manipulation by non-root users
Repeated invocations of nft or netlink NFNL_SUBSYS_NFTABLES transactions from unprivileged processes

Detection Strategies

Monitor kernel audit logs for processes invoking nftables netlink operations without legitimate administrative justification
Detect creation of user namespaces followed by netfilter configuration activity, which is a common precursor to kernel race exploitation
Track module autoload events for nf_tables submodules originating from low-privileged contexts

Monitoring Recommendations

Enable kernel lockdep and KASAN on test systems to surface lock ordering violations and use-after-free conditions in netfilter code paths
Centralize dmesg and audit logs to a security data lake for correlation across hosts
Alert on repeated nft command execution by non-administrative users or service accounts

How to Mitigate CVE-2024-26925

Immediate Actions Required

Apply the upstream kernel patches referenced in the vendor advisories to all affected systems
Identify Linux hosts running kernel 6.5, 6.9-rc1, 6.9-rc2, or unpatched stable branches and prioritize them for update
Restrict creation of unprivileged user namespaces where business requirements permit, using sysctl kernel.unprivileged_userns_clone=0 on Debian-based systems

Patch Information

The fix is committed across multiple stable kernel branches. Reference commits include 0d459e2ffb54, 2cee2ff7f8cc, 61ac7284346c, 8038ee3c3e5b, 8d3a58af50e4, a34ba4bdeec0, and eb769ff4e281. Debian users should consult the Debian LTS Security Announcement. Siemens customers should review the Siemens Product Security Advisory SSA-265688 and Siemens Product Security Advisory SSA-354112.

Workarounds

Disable unprivileged user namespaces to prevent low-privilege exploitation paths into netfilter
Restrict CAP_NET_ADMIN to trusted administrative accounts and remove from container workloads where possible
Blacklist the nf_tables module on systems that do not require it using modprobe.d configuration

bash

# Disable unprivileged user namespaces (Debian/Ubuntu)
sudo sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-cve-2024-26925.conf

# Optional: blacklist nf_tables if not required
echo 'blacklist nf_tables' | sudo tee /etc/modprobe.d/blacklist-nf_tables.conf