CVE-2024-27397: Linux Kernel Race Condition Vulnerability

CVE-2024-27397 Overview

CVE-2024-27397 is a use-after-free vulnerability [CWE-416] in the Linux kernel's netfilter subsystem, specifically in nf_tables set element timeout handling. The flaw occurs because set elements could expire while a control plane transaction was still unfinished, leading to inconsistent state and memory safety issues. The kernel maintainers resolved the issue by introducing a transaction timestamp stored in the nftables per-netns area, ensuring that .insert, .deactivate, and sync garbage collection paths reference a consistent point in time.

Critical Impact
A local attacker with the CAP_NET_ADMIN capability inside a user namespace can trigger the use-after-free condition to corrupt kernel memory, potentially leading to local privilege escalation.

Affected Products

Linux Kernel versions prior to the patched stable releases
Linux Kernel 6.8-rc1, 6.8-rc2, and 6.8-rc3
Debian and Siemens products bundling affected kernel versions

Discovery Timeline

2024-05-14 - CVE-2024-27397 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2024-27397

Vulnerability Analysis

The vulnerability resides in the nf_tables set element timeout logic. Set elements in nftables carry an expiration time used by garbage collection (GC). Prior to the fix, set backend operations such as .insert, .deactivate, and the synchronous GC path read the current time directly when evaluating expiration. Long-running control plane transactions could therefore observe elements expiring mid-transaction. This created a race where an element being committed could be freed by GC, producing a use-after-free condition in kernel memory.

The patch introduces a timestamp captured at the start of each transaction and stored in the per-netns nftables state. Backend paths invoked from transaction context now reference this stable timestamp instead of jiffies directly. Packet path lookups (.lookup, .update), lockless RCU readers (.get, dump), and the asynchronous workqueue GC continue to use the current time because they operate outside transaction scope.

Root Cause

The root cause is a time-of-check to time-of-use (TOCTOU) inconsistency. Different code paths observed different notions of "now" while operating on the same set element. Garbage collection could free an element that a still-running transaction considered live, leaving dangling references in commit logic.

Attack Vector

Exploitation requires local access and the ability to create or manipulate nftables sets, typically through CAP_NET_ADMIN. On distributions allowing unprivileged user namespaces, a local user can obtain this capability inside a namespace. The attacker creates set elements with short timeouts and races their expiration against control plane operations to trigger the use-after-free.

No verified public exploit code is available. Refer to the upstream commits linked under Kernel Commit Changes for the authoritative fix.

Detection Methods for CVE-2024-27397

Indicators of Compromise

Unexpected kernel oops or general protection fault messages referencing nft_set_elem or nf_tables functions in dmesg
KASAN use-after-free reports involving netfilter set element structures on instrumented kernels
Crashes or memory corruption during high-frequency nft rule reloads

Detection Strategies

Inventory running kernel versions across Linux hosts and compare against fixed stable releases referenced in the upstream commits
Monitor for processes invoking nft or iptables-nft with rapid set element insertion and deletion patterns from non-administrative users
Audit user namespace creation by unprivileged processes, which is a prerequisite for obtaining CAP_NET_ADMIN on multi-tenant systems

Monitoring Recommendations

Enable kernel auditd rules for unshare, clone with CLONE_NEWUSER, and setns syscalls
Collect kernel ring buffer logs centrally and alert on oops or panic strings referencing netfilter
Track package update status for kernel components on Debian, Siemens SIMATIC, and other affected distributions

How to Mitigate CVE-2024-27397

Immediate Actions Required

Apply the latest stable kernel update from your distribution that incorporates the upstream fix commits
For Debian systems, install the kernel updates announced in the Debian LTS Announcement (October 2024) and Debian LTS Announcement (January 2025)
For Siemens industrial products, follow the remediation guidance in the Siemens Security Advisory SSA-265688
Restrict unprivileged user namespace creation on systems that do not require it

Patch Information

The fix is committed upstream across multiple stable branches. Reference commits include 7395dfacfff6, 383182db8d58, 0d40e8cb1d1f, and f8dfda798650. See Kernel Commit 7395dfacfff6 for the canonical patch introducing the per-netns transaction timestamp.

Workarounds

Disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0 on Debian-derived systems or user.max_user_namespaces=0 via sysctl
Restrict nftables administration to trusted users by removing CAP_NET_ADMIN from non-administrative service accounts
Where feasible, blacklist the nf_tables module on hosts that do not require it

bash

# Disable unprivileged user namespaces (Debian/Ubuntu)
sudo sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-disable-userns.conf

# Alternative: cap maximum user namespaces to zero
sudo sysctl -w user.max_user_namespaces=0

# Verify installed kernel version against fixed releases
uname -r
apt list --installed 2>/dev/null | grep linux-image