Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-p85j-rtx2-d3cm
Vulnerability ID VCID-p85j-rtx2-d3cm
Aliases CVE-2024-27012
Summary In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: restore set elements when delete set fails From abort path, nft_mapelem_activate() needs to restore refcounters to the original state. Currently, it uses the set->ops->walk() to iterate over these set elements. The existing set iterator skips inactive elements in the next generation, this does not work from the abort path to restore the original state since it has to skip active elements instead (not inactive ones). This patch moves the check for inactive elements to the set iterator callback, then it reverses the logic for the .activate case which needs to skip active elements. Toggle next generation bit for elements when delete set command is invoked and call nft_clear() from .activate (abort) path to restore the next generation bit. The splat below shows an object in mappings memleak: [43929.457523] ------------[ cut here ]------------ [43929.457532] WARNING: CPU: 0 PID: 1139 at include/net/netfilter/nf_tables.h:1237 nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] [...] [43929.458014] RIP: 0010:nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] [43929.458076] Code: 83 f8 01 77 ab 49 8d 7c 24 08 e8 37 5e d0 de 49 8b 6c 24 08 48 8d 7d 50 e8 e9 5c d0 de 8b 45 50 8d 50 ff 89 55 50 85 c0 75 86 <0f> 0b eb 82 0f 0b eb b3 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 [43929.458081] RSP: 0018:ffff888140f9f4b0 EFLAGS: 00010246 [43929.458086] RAX: 0000000000000000 RBX: ffff8881434f5288 RCX: dffffc0000000000 [43929.458090] RDX: 00000000ffffffff RSI: ffffffffa26d28a7 RDI: ffff88810ecc9550 [43929.458093] RBP: ffff88810ecc9500 R08: 0000000000000001 R09: ffffed10281f3e8f [43929.458096] R10: 0000000000000003 R11: ffff0000ffff0000 R12: ffff8881434f52a0 [43929.458100] R13: ffff888140f9f5f4 R14: ffff888151c7a800 R15: 0000000000000002 [43929.458103] FS: 00007f0c687c4740(0000) GS:ffff888390800000(0000) knlGS:0000000000000000 [43929.458107] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [43929.458111] CR2: 00007f58dbe5b008 CR3: 0000000123602005 CR4: 00000000001706f0 [43929.458114] Call Trace: [43929.458118] <TASK> [43929.458121] ? __warn+0x9f/0x1a0 [43929.458127] ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] [43929.458188] ? report_bug+0x1b1/0x1e0 [43929.458196] ? handle_bug+0x3c/0x70 [43929.458200] ? exc_invalid_op+0x17/0x40 [43929.458211] ? nft_setelem_data_deactivate+0xd7/0xf0 [nf_tables] [43929.458271] ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] [43929.458332] nft_mapelem_deactivate+0x24/0x30 [nf_tables] [43929.458392] nft_rhash_walk+0xdd/0x180 [nf_tables] [43929.458453] ? __pfx_nft_rhash_walk+0x10/0x10 [nf_tables] [43929.458512] ? rb_insert_color+0x2e/0x280 [43929.458520] nft_map_deactivate+0xdc/0x1e0 [nf_tables] [43929.458582] ? __pfx_nft_map_deactivate+0x10/0x10 [nf_tables] [43929.458642] ? __pfx_nft_mapelem_deactivate+0x10/0x10 [nf_tables] [43929.458701] ? __rcu_read_unlock+0x46/0x70 [43929.458709] nft_delset+0xff/0x110 [nf_tables] [43929.458769] nft_flush_table+0x16f/0x460 [nf_tables] [43929.458830] nf_tables_deltable+0x501/0x580 [nf_tables]
Status Published
Exploitability 0.5
Weighted Severity 5.0
Risk 2.5
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
cvssv3 5.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-27012.json
epss 8e-05 https://api.first.org/data/v1/epss?cve=CVE-2024-27012
epss 8e-05 https://api.first.org/data/v1/epss?cve=CVE-2024-27012
cvssv3.1 5.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
ssvc Track https://git.kernel.org/stable/c/86658fc7414d4b9e25c2699d751034537503d637
ssvc Track https://git.kernel.org/stable/c/e79b47a8615d42c68aaeb68971593333667382ed
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-27012.json
https://api.first.org/data/v1/epss?cve=CVE-2024-27012
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27012
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
2278275 https://bugzilla.redhat.com/show_bug.cgi?id=2278275
86658fc7414d4b9e25c2699d751034537503d637 https://git.kernel.org/stable/c/86658fc7414d4b9e25c2699d751034537503d637
e79b47a8615d42c68aaeb68971593333667382ed https://git.kernel.org/stable/c/e79b47a8615d42c68aaeb68971593333667382ed
RHSA-2024:9315 https://access.redhat.com/errata/RHSA-2024:9315
RHSA-2025:1658 https://access.redhat.com/errata/RHSA-2025:1658
USN-6893-1 https://usn.ubuntu.com/6893-1/
USN-6893-2 https://usn.ubuntu.com/6893-2/
USN-6893-3 https://usn.ubuntu.com/6893-3/
USN-6918-1 https://usn.ubuntu.com/6918-1/
USN-7021-1 https://usn.ubuntu.com/7021-1/
USN-7021-2 https://usn.ubuntu.com/7021-2/
USN-7021-3 https://usn.ubuntu.com/7021-3/
USN-7021-4 https://usn.ubuntu.com/7021-4/
USN-7021-5 https://usn.ubuntu.com/7021-5/
USN-7022-1 https://usn.ubuntu.com/7022-1/
USN-7022-2 https://usn.ubuntu.com/7022-2/
USN-7022-3 https://usn.ubuntu.com/7022-3/
USN-7119-1 https://usn.ubuntu.com/7119-1/
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-27012.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-14T18:56:10Z/ Found at https://git.kernel.org/stable/c/86658fc7414d4b9e25c2699d751034537503d637
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-14T18:56:10Z/ Found at https://git.kernel.org/stable/c/e79b47a8615d42c68aaeb68971593333667382ed
Exploit Prediction Scoring System (EPSS)
Percentile 0.00865
EPSS Score 8e-05
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:50:13.650391+00:00 Debian Importer Import https://security-tracker.debian.org/tracker/data/json 38.6.0