Vulnerability identifier: #VU93809

Vulnerability risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26808

CWE-ID: CWE-825

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a stale reference within the nf_tables_netdev_event() function in net/netfilter/nft_chain_filter.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/9489e214ea8f2a90345516016aa51f2db3a8cc2f
http://git.kernel.org/stable/c/70f17b48c86622217a58d5099d29242fc9adac58
http://git.kernel.org/stable/c/af149a46890e8285d1618bd68b8d159bdb87fdb3
http://git.kernel.org/stable/c/e5888acbf1a3d8d021990ce6c6061fd5b2bb21b4
http://git.kernel.org/stable/c/36a0a80f32209238469deb481967d777a3d539ee
http://git.kernel.org/stable/c/01acb2e8666a6529697141a6017edbf206921913
http://lists.debian.org/debian-lts-announce/2024/06/msg00017.html

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.