netfilter: nft_set_pipapo: do not free live element

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2024-26924
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2024-04-25 06:15:57 UTC
Updated2026-08-04 11:17:22 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: do not free live element Pablo reports a crash with large batches of elements with a back-to-back add/remove pattern. Quoting Pablo: add_elem("00000000") timeout 100 ms ... add_elem("0000000X") timeout 100 ms del_elem("0000000X") <---------------- delete one that was just added ... add_elem("00005000") timeout 100 ms 1) nft_pipapo_remove() removes element 0000000X Then, KASAN shows a splat. Looking at the remove function there is a chance that we will drop a rule that maps to a non-deactivated element. Removal happens in two steps, first we do a lookup for key k and return the to-be-removed element and mark it as inactive in the next generation. Then, in a second step, the element gets removed from the set/map. The _remove function does not work correctly if we have more than one element that share the same key. This can happen if we insert an element into a set when the set already holds an element with same key, but the element mapping to the existing key has timed out or is not active in the next generation. In such case its possible that removal will unmap the wrong element. If this happens, we will leak the non-deactivated element, it becomes unreachable. The element that got deactivated (and will be freed later) will remain reachable in the set data structure, this can result in a crash when such an element is retrieved during lookup (stale pointer). Add a check that the fully matching key does in fact map to the element that we have marked as inactive in the deactivation step. If not, we need to continue searching. Add a bug/warn trap at the end of the function as well, the remove function must not ever be called with an invisible/unreachable/non-existent element. v2: avoid uneeded temporary variable (Stefano)

Risk And Classification

Primary CVSS: v3.1 5.9 MEDIUM from ADP

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Problem Types: CWE-476 | CWE-476 CWE-476 NULL Pointer Dereference

VersionSourceTypeScoreSeverityVector
3.1ADPDECLARED5.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary5.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
3.1CNADECLARED7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 3c4287f62044a90e73a561aa05fc46e62da173da e3b887a9c11caf8357a821260e095f2a694a34f2 git Not specified
CNA Linux Linux affected 3c4287f62044a90e73a561aa05fc46e62da173da 7a1679e2d9bfa3b5f8755c2c7113e54b7d42bd46 git Not specified
CNA Linux Linux affected 3c4287f62044a90e73a561aa05fc46e62da173da 41d8fdf3afaff312e17466e4ab732937738d5644 git Not specified
CNA Linux Linux affected 3c4287f62044a90e73a561aa05fc46e62da173da ebf7c9746f073035ee26209e38c3a1170f7b349a git Not specified
CNA Linux Linux affected 3c4287f62044a90e73a561aa05fc46e62da173da 14b001ba221136c15f894577253e8db535b99487 git Not specified
CNA Linux Linux affected 3c4287f62044a90e73a561aa05fc46e62da173da 3cfc9ec039af60dbd8965ae085b2c2ccdcfbe1cc git Not specified
CNA Linux Linux affected 5.6 Not specified
CNA Linux Linux unaffected 5.6 semver Not specified
CNA Linux Linux unaffected 5.10.216 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.157 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.88 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.29 6.6.* semver Not specified
CNA Linux Linux unaffected 6.8.8 6.8.* semver Not specified
CNA Linux Linux unaffected 6.9 * original_commit_for_fix Not specified
ADP Linux Linux Kernel affected 5.6 Not specified
ADP Linux Linux Kernel affected 3c4287f62044 Not specified

References

ReferenceSourceLinkTags
lists.debian.org/debian-lts-announce/2024/06/msg00017.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org Mailing List, Third Party Advisory
git.kernel.org/stable/c/ebf7c9746f073035ee26209e38c3a1170f7b349a af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/3cfc9ec039af60dbd8965ae085b2c2ccdcfbe1cc af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
lists.fedoraproject.org/archives/list/[email protected]/messag... af854a3a-2127-422b-91ae-364da2661108 lists.fedoraproject.org
git.kernel.org/stable/c/7a1679e2d9bfa3b5f8755c2c7113e54b7d42bd46 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/41d8fdf3afaff312e17466e4ab732937738d5644 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/14b001ba221136c15f894577253e8db535b99487 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
lists.fedoraproject.org/archives/list/[email protected]/messag... af854a3a-2127-422b-91ae-364da2661108 lists.fedoraproject.org
lists.fedoraproject.org/archives/list/[email protected]/messag... af854a3a-2127-422b-91ae-364da2661108 lists.fedoraproject.org
git.kernel.org/stable/c/e3b887a9c11caf8357a821260e095f2a694a34f2 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report