{"dataType":"CVE_RECORD","cveMetadata":{"cveId":"CVE-2024-26581","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-02-19T14:20:24.125Z","datePublished":"2024-02-20T12:52:57.398Z","dateUpdated":"2026-08-05T11:26:00.062Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:26:00.062Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_rbtree: skip end interval element from gc\n\nrbtree lazy gc on insert might collect an end interval element that has\nbeen just added in this transactions, skip end interval elements that\nare not yet active."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached through the NETLINK_NETFILTER socket by issuing an nftables `NFT_MSG_NEWSETELEM` batch; it requires local system access to open the netlink socket and cannot be triggered by remote packets.\nAC:L - Every precondition — element timeout value, key ordering in the rbtree, insertion order of the interval end/start elements, and whether the batch commits or aborts — is fully controlled by the attacker within a single netlink batch, making the erroneous GC removal and subsequent double-free deterministic with no race to win.\nPR:L - The path is gated only by `netlink_net_capable(skb, CAP_NET_ADMIN)`, which resolves to `ns_capable(net->user_ns, CAP_NET_ADMIN)`; an ordinary unprivileged user obtains this via `unshare -Urn` on default-configured distributions.\nUI:N - The attacker performs the entire sequence — set creation, element expiry, and the triggering insert batch — from their own process with no victim action required.\nS:U - The corruption and any resulting privilege escalation occur entirely within the kernel's own security authority; no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - On commit the freed element is read back by `nf_tables_setelem_notify()` and its contents are sent to userspace over netlink, and the double-free/UAF gives the attacker a reclaimed-slab read primitive over arbitrary kernel heap data.\nI:H - `nft_rbtree_activate()` writes into the freed object, `nft_set_elem_destroy()` double-frees it, and `nft_data_release()`/`nft_use_dec()` underflow the referenced chain/object use counters — a combination that yields controlled heap write primitives and full privilege escalation, as with the closely related exploited nftables refcount/double-free bugs.\nA:H - The use-after-free, double free, rbtree node corruption, and `nelems` underflow reliably produce kernel oopses or panics, and the sync GC path also hits `WARN_ON_ONCE` splats."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nft_set_rbtree.c"],"versions":[{"version":"8284a79136c384059e85e278da2210b809730287","lessThan":"c60d252949caf9aba537525195edae6bbabc35eb","status":"affected","versionType":"git"},{"version":"acaee227cf79c45a5d2d49c3e9a66333a462802c","lessThan":"10e9cb39313627f2eae4cd70c4b742074e998fd8","status":"affected","versionType":"git"},{"version":"893cb3c3513cf661a0ff45fe0cfa83fe27131f76","lessThan":"4cee42fcf54fec46b344681e7cc4f234bb22f85a","status":"affected","versionType":"git"},{"version":"50cbb9d195c197af671869c8cadce3bd483735a0","lessThan":"2bab493a5624444ec6e648ad0d55a362bcb4c003","status":"affected","versionType":"git"},{"version":"89a4d1a89751a0fbd520e64091873e19cc0979e8","lessThan":"1296c110c5a0b45a8fcf58e7d18bc5da61a565cb","status":"affected","versionType":"git"},{"version":"f718863aca469a109895cb855e6b81fff4827d71","lessThan":"b734f7a47aeb32a5ba298e4ccc16bb0c52b6dbf7","status":"affected","versionType":"git"},{"version":"f718863aca469a109895cb855e6b81fff4827d71","lessThan":"6eb14441f10602fa1cf691da9d685718b68b78a9","status":"affected","versionType":"git"},{"version":"f718863aca469a109895cb855e6b81fff4827d71","lessThan":"60c0c230c6f046da536d3df8b39a20b9a9fd6af0","status":"affected","versionType":"git"},{"version":"cd66733932399475fe933cb3ec03e687ed401462","status":"affected","versionType":"git"},{"version":"5.4.262","lessThan":"5.4.269","status":"affected","versionType":"semver"},{"version":"5.10.190","lessThan":"5.10.210","status":"affected","versionType":"semver"},{"version":"5.15.124","lessThan":"5.15.149","status":"affected","versionType":"semver"},{"version":"6.1.43","lessThan":"6.1.78","status":"affected","versionType":"semver"},{"version":"6.4.8","lessThan":"6.5","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nft_set_rbtree.c"],"versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","status":"unaffected","versionType":"semver"},{"version":"5.4.269","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.210","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.149","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.78","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.17","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.7.5","lessThanOrEqual":"6.7.*","status":"unaffected","versionType":"semver"},{"version":"6.8","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.262","versionEndExcluding":"5.4.269"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.190","versionEndExcluding":"5.10.210"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.124","versionEndExcluding":"5.15.149"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.43","versionEndExcluding":"6.1.78"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.6.17"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.7.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4.8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/c60d252949caf9aba537525195edae6bbabc35eb"},{"url":"https://git.kernel.org/stable/c/10e9cb39313627f2eae4cd70c4b742074e998fd8"},{"url":"https://git.kernel.org/stable/c/4cee42fcf54fec46b344681e7cc4f234bb22f85a"},{"url":"https://git.kernel.org/stable/c/2bab493a5624444ec6e648ad0d55a362bcb4c003"},{"url":"https://git.kernel.org/stable/c/1296c110c5a0b45a8fcf58e7d18bc5da61a565cb"},{"url":"https://git.kernel.org/stable/c/b734f7a47aeb32a5ba298e4ccc16bb0c52b6dbf7"},{"url":"https://git.kernel.org/stable/c/6eb14441f10602fa1cf691da9d685718b68b78a9"},{"url":"https://git.kernel.org/stable/c/60c0c230c6f046da536d3df8b39a20b9a9fd6af0"}],"title":"netfilter: nft_set_rbtree: skip end interval element from gc","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"problemTypes":[{"descriptions":[{"type":"CWE","lang":"en","description":"CWE-noinfo Not enough information"}]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-10-30T19:31:46.616632Z","id":"CVE-2024-26581","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-10-01T19:10:25.971Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T00:07:19.615Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/c60d252949caf9aba537525195edae6bbabc35eb","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/10e9cb39313627f2eae4cd70c4b742074e998fd8","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/4cee42fcf54fec46b344681e7cc4f234bb22f85a","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/2bab493a5624444ec6e648ad0d55a362bcb4c003","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/1296c110c5a0b45a8fcf58e7d18bc5da61a565cb","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/b734f7a47aeb32a5ba298e4ccc16bb0c52b6dbf7","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/6eb14441f10602fa1cf691da9d685718b68b78a9","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/60c0c230c6f046da536d3df8b39a20b9a9fd6af0","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","tags":["x_transferred"]}]}]},"dataVersion":"5.2"}