CVE-2024-26809: netfilter: nft_set_pipapo: release elements in clone only from destroy path
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftsetpipapo: release elements in clone only from destroy path
Clone already always provides a current view of the lookup table, use it to destroy the set, otherwise it is possible to destroy elements twice.
This fix requires:
212ed75dc5fb ("netfilter: nftables: integrate pipapo into commit protocol")
which came after:
9827a0e6e23b ("netfilter: nftsetpipapo: release elements in clone from abort path").
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 212ed75dc5fb - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 9827a0e6e23b
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26809?
CVE-2024-26809 has been classified with a medium severity level due to its potential impact on the Linux kernel's netfilter.
How do I fix CVE-2024-26809?
To fix CVE-2024-26809, update your Linux kernel to one of the patched versions: 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.11-1, or 6.12.12-1.
Which Linux kernel versions are affected by CVE-2024-26809?
CVE-2024-26809 affects several versions of the Linux kernel prior to the patched releases mentioned above.
What type of vulnerability is CVE-2024-26809?
CVE-2024-26809 is a vulnerability in the Linux kernel's netfilter module related to improper handling of elements during the cloning process.
Can CVE-2024-26809 lead to a denial of service?
Yes, CVE-2024-26809 may potentially lead to a denial of service if exploited due to improper element destruction.