CVE-2024-26581

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-26581", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.125Z", "datePublished": "2024-02-20T12:52:57.398Z", "dateUpdated": "2026-08-05T11:26:00.062Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:26:00.062Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_rbtree: skip end interval element from gc\n\nrbtree lazy gc on insert might collect an end interval element that has\nbeen just added in this transactions, skip end interval elements that\nare not yet active."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached through the NETLINK_NETFILTER socket by issuing an nftables `NFT_MSG_NEWSETELEM` batch; it requires local system access to open the netlink socket and cannot be triggered by remote packets.\nAC:L - Every precondition \u2014 element timeout value, key ordering in the rbtree, insertion order of the interval end/start elements, and whether the batch commits or aborts \u2014 is fully controlled by the attacker within a single netlink batch, making the erroneous GC removal and subsequent double-free deterministic with no race to win.\nPR:L - The path is gated only by `netlink_net_capable(skb, CAP_NET_ADMIN)`, which resolves to `ns_capable(net->user_ns, CAP_NET_ADMIN)`; an ordinary unprivileged user obtains this via `unshare -Urn` on default-configured distributions.\nUI:N - The attacker performs the entire sequence \u2014 set creation, element expiry, and the triggering insert batch \u2014 from their own process with no victim action required.\nS:U - The corruption and any resulting privilege escalation occur entirely within the kernel's own security authority; no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - On commit the freed element is read back by `nf_tables_setelem_notify()` and its contents are sent to userspace over netlink, and the double-free/UAF gives the attacker a reclaimed-slab read primitive over arbitrary kernel heap data.\nI:H - `nft_rbtree_activate()` writes into the freed object, `nft_set_elem_destroy()` double-frees it, and `nft_data_release()`/`nft_use_dec()` underflow the referenced chain/object use counters \u2014 a combination that yields controlled heap write primitives and full privilege escalation, as with the closely related exploited nftables refcount/double-free bugs.\nA:H - The use-after-free, double free, rbtree node corruption, and `nelems` underflow reliably produce kernel oopses or panics, and the sync GC path also hits `WARN_ON_ONCE` splats."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nft_set_rbtree.c"], "versions": [{"version": "8284a79136c384059e85e278da2210b809730287", "lessThan": "c60d252949caf9aba537525195edae6bbabc35eb", "status": "affected", "versionType": "git"}, {"version": "acaee227cf79c45a5d2d49c3e9a66333a462802c", "lessThan": "10e9cb39313627f2eae4cd70c4b742074e998fd8", "status": "affected", "versionType": "git"}, {"version": "893cb3c3513cf661a0ff45fe0cfa83fe27131f76", "lessThan": "4cee42fcf54fec46b344681e7cc4f234bb22f85a", "status": "affected", "versionType": "git"}, {"version": "50cbb9d195c197af671869c8cadce3bd483735a0", "lessThan": "2bab493a5624444ec6e648ad0d55a362bcb4c003", "status": "affected", "versionType": "git"}, {"version": "89a4d1a89751a0fbd520e64091873e19cc0979e8", "lessThan": "1296c110c5a0b45a8fcf58e7d18bc5da61a565cb", "status": "affected", "versionType": "git"}, {"version": "f718863aca469a109895cb855e6b81fff4827d71", "lessThan": "b734f7a47aeb32a5ba298e4ccc16bb0c52b6dbf7", "status": "affected", "versionType": "git"}, {"version": "f718863aca469a109895cb855e6b81fff4827d71", "lessThan": "6eb14441f10602fa1cf691da9d685718b68b78a9", "status": "affected", "versionType": "git"}, {"version": "f718863aca469a109895cb855e6b81fff4827d71", "lessThan": "60c0c230c6f046da536d3df8b39a20b9a9fd6af0", "status": "affected", "versionType": "git"}, {"version": "cd66733932399475fe933cb3ec03e687ed401462", "status": "affected", "versionType": "git"}, {"version": "5.4.262", "lessThan": "5.4.269", "status": "affected", "versionType": "semver"}, {"version": "5.10.190", "lessThan": "5.10.210", "status": "affected", "versionType": "semver"}, {"version": "5.15.124", "lessThan": "5.15.149", "status": "affected", "versionType": "semver"}, {"version": "6.1.43", "lessThan": "6.1.78", "status": "affected", "versionType": "semver"}, {"version": "6.4.8", "lessThan": "6.5", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nft_set_rbtree.c"], "versions": [{"version": "6.5", "status": "affected"}, {"version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.269", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.210", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.149", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.78", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.17", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.5", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.262", "versionEndExcluding": "5.4.269"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.190", "versionEndExcluding": "5.10.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.124", "versionEndExcluding": "5.15.149"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.43", "versionEndExcluding": "6.1.78"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.6.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.7.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c60d252949caf9aba537525195edae6bbabc35eb"}, {"url": "https://git.kernel.org/stable/c/10e9cb39313627f2eae4cd70c4b742074e998fd8"}, {"url": "https://git.kernel.org/stable/c/4cee42fcf54fec46b344681e7cc4f234bb22f85a"}, {"url": "https://git.kernel.org/stable/c/2bab493a5624444ec6e648ad0d55a362bcb4c003"}, {"url": "https://git.kernel.org/stable/c/1296c110c5a0b45a8fcf58e7d18bc5da61a565cb"}, {"url": "https://git.kernel.org/stable/c/b734f7a47aeb32a5ba298e4ccc16bb0c52b6dbf7"}, {"url": "https://git.kernel.org/stable/c/6eb14441f10602fa1cf691da9d685718b68b78a9"}, {"url": "https://git.kernel.org/stable/c/60c0c230c6f046da536d3df8b39a20b9a9fd6af0"}], "title": "netfilter: nft_set_rbtree: skip end interval element from gc", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-noinfo Not enough information"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-10-30T19:31:46.616632Z", "id": "CVE-2024-26581", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T19:10:25.971Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:07:19.615Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/c60d252949caf9aba537525195edae6bbabc35eb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/10e9cb39313627f2eae4cd70c4b742074e998fd8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4cee42fcf54fec46b344681e7cc4f234bb22f85a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2bab493a5624444ec6e648ad0d55a362bcb4c003", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1296c110c5a0b45a8fcf58e7d18bc5da61a565cb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b734f7a47aeb32a5ba298e4ccc16bb0c52b6dbf7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/6eb14441f10602fa1cf691da9d685718b68b78a9", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/60c0c230c6f046da536d3df8b39a20b9a9fd6af0", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/c60d252949caf9aba537525195edae6bbabc35eb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/10e9cb39313627f2eae4cd70c4b742074e998fd8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4cee42fcf54fec46b344681e7cc4f234bb22f85a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2bab493a5624444ec6e648ad0d55a362bcb4c003", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1296c110c5a0b45a8fcf58e7d18bc5da61a565cb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b734f7a47aeb32a5ba298e4ccc16bb0c52b6dbf7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/6eb14441f10602fa1cf691da9d685718b68b78a9", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/60c0c230c6f046da536d3df8b39a20b9a9fd6af0", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:07:19.615Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-26581", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-30T19:31:46.616632Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-24T20:37:28.519Z"}}], "cna": {"title": "netfilter: nft_set_rbtree: skip end interval element from gc", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached through the NETLINK_NETFILTER socket by issuing an nftables `NFT_MSG_NEWSETELEM` batch; it requires local system access to open the netlink socket and cannot be triggered by remote packets.\nAC:L - Every precondition \u2014 element timeout value, key ordering in the rbtree, insertion order of the interval end/start elements, and whether the batch commits or aborts \u2014 is fully controlled by the attacker within a single netlink batch, making the erroneous GC removal and subsequent double-free deterministic with no race to win.\nPR:L - The path is gated only by `netlink_net_capable(skb, CAP_NET_ADMIN)`, which resolves to `ns_capable(net->user_ns, CAP_NET_ADMIN)`; an ordinary unprivileged user obtains this via `unshare -Urn` on default-configured distributions.\nUI:N - The attacker performs the entire sequence \u2014 set creation, element expiry, and the triggering insert batch \u2014 from their own process with no victim action required.\nS:U - The corruption and any resulting privilege escalation occur entirely within the kernel's own security authority; no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - On commit the freed element is read back by `nf_tables_setelem_notify()` and its contents are sent to userspace over netlink, and the double-free/UAF gives the attacker a reclaimed-slab read primitive over arbitrary kernel heap data.\nI:H - `nft_rbtree_activate()` writes into the freed object, `nft_set_elem_destroy()` double-frees it, and `nft_data_release()`/`nft_use_dec()` underflow the referenced chain/object use counters \u2014 a combination that yields controlled heap write primitives and full privilege escalation, as with the closely related exploited nftables refcount/double-free bugs.\nA:H - The use-after-free, double free, rbtree node corruption, and `nelems` underflow reliably produce kernel oopses or panics, and the sync GC path also hits `WARN_ON_ONCE` splats."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "8284a79136c384059e85e278da2210b809730287", "lessThan": "c60d252949caf9aba537525195edae6bbabc35eb", "versionType": "git"}, {"status": "affected", "version": "acaee227cf79c45a5d2d49c3e9a66333a462802c", "lessThan": "10e9cb39313627f2eae4cd70c4b742074e998fd8", "versionType": "git"}, {"status": "affected", "version": "893cb3c3513cf661a0ff45fe0cfa83fe27131f76", "lessThan": "4cee42fcf54fec46b344681e7cc4f234bb22f85a", "versionType": "git"}, {"status": "affected", "version": "50cbb9d195c197af671869c8cadce3bd483735a0", "lessThan": "2bab493a5624444ec6e648ad0d55a362bcb4c003", "versionType": "git"}, {"status": "affected", "version": "89a4d1a89751a0fbd520e64091873e19cc0979e8", "lessThan": "1296c110c5a0b45a8fcf58e7d18bc5da61a565cb", "versionType": "git"}, {"status": "affected", "version": "f718863aca469a109895cb855e6b81fff4827d71", "lessThan": "b734f7a47aeb32a5ba298e4ccc16bb0c52b6dbf7", "versionType": "git"}, {"status": "affected", "version": "f718863aca469a109895cb855e6b81fff4827d71", "lessThan": "6eb14441f10602fa1cf691da9d685718b68b78a9", "versionType": "git"}, {"status": "affected", "version": "f718863aca469a109895cb855e6b81fff4827d71", "lessThan": "60c0c230c6f046da536d3df8b39a20b9a9fd6af0", "versionType": "git"}, {"status": "affected", "version": "cd66733932399475fe933cb3ec03e687ed401462", "versionType": "git"}, {"status": "affected", "version": "5.4.262", "lessThan": "5.4.269", "versionType": "semver"}, {"status": "affected", "version": "5.10.190", "lessThan": "5.10.210", "versionType": "semver"}, {"status": "affected", "version": "5.15.124", "lessThan": "5.15.149", "versionType": "semver"}, {"status": "affected", "version": "6.1.43", "lessThan": "6.1.78", "versionType": "semver"}, {"status": "affected", "version": "6.4.8", "lessThan": "6.5", "versionType": "semver"}], "programFiles": ["net/netfilter/nft_set_rbtree.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"status": "unaffected", "version": "0", "lessThan": "6.5", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.269", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.210", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.149", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.78", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.17", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.5", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/netfilter/nft_set_rbtree.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/c60d252949caf9aba537525195edae6bbabc35eb"}, {"url": "https://git.kernel.org/stable/c/10e9cb39313627f2eae4cd70c4b742074e998fd8"}, {"url": "https://git.kernel.org/stable/c/4cee42fcf54fec46b344681e7cc4f234bb22f85a"}, {"url": "https://git.kernel.org/stable/c/2bab493a5624444ec6e648ad0d55a362bcb4c003"}, {"url": "https://git.kernel.org/stable/c/1296c110c5a0b45a8fcf58e7d18bc5da61a565cb"}, {"url": "https://git.kernel.org/stable/c/b734f7a47aeb32a5ba298e4ccc16bb0c52b6dbf7"}, {"url": "https://git.kernel.org/stable/c/6eb14441f10602fa1cf691da9d685718b68b78a9"}, {"url": "https://git.kernel.org/stable/c/60c0c230c6f046da536d3df8b39a20b9a9fd6af0"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_rbtree: skip end interval element from gc\n\nrbtree lazy gc on insert might collect an end interval element that has\nbeen just added in this transactions, skip end interval elements that\nare not yet active."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.269", "versionStartIncluding": "5.4.262"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.210", "versionStartIncluding": "5.10.190"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.149", "versionStartIncluding": "5.15.124"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.78", "versionStartIncluding": "6.1.43"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.17", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.5", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.4.8"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:26:00.062Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26581", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:26:00.062Z", "dateReserved": "2024-02-19T14:20:24.125Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-02-20T12:52:57.398Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/netfilter/nft_set_rbtree.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c60d252949caf9aba537525195edae6bbabc35eb", "status": "affected", "version": "8284a79136c384059e85e278da2210b809730287", "versionType": "git"}, {"lessThan": "10e9cb39313627f2eae4cd70c4b742074e998fd8", "status": "affected", "version": "acaee227cf79c45a5d2d49c3e9a66333a462802c", "versionType": "git"}, {"lessThan": "4cee42fcf54fec46b344681e7cc4f234bb22f85a", "status": "affected", "version": "893cb3c3513cf661a0ff45fe0cfa83fe27131f76", "versionType": "git"}, {"lessThan": "2bab493a5624444ec6e648ad0d55a362bcb4c003", "status": "affected", "version": "50cbb9d195c197af671869c8cadce3bd483735a0", "versionType": "git"}, {"lessThan": "1296c110c5a0b45a8fcf58e7d18bc5da61a565cb", "status": "affected", "version": "89a4d1a89751a0fbd520e64091873e19cc0979e8", "versionType": "git"}, {"lessThan": "b734f7a47aeb32a5ba298e4ccc16bb0c52b6dbf7", "status": "affected", "version": "f718863aca469a109895cb855e6b81fff4827d71", "versionType": "git"}, {"lessThan": "6eb14441f10602fa1cf691da9d685718b68b78a9", "status": "affected", "version": "f718863aca469a109895cb855e6b81fff4827d71", "versionType": "git"}, {"lessThan": "60c0c230c6f046da536d3df8b39a20b9a9fd6af0", "status": "affected", "version": "f718863aca469a109895cb855e6b81fff4827d71", "versionType": "git"}, {"status": "affected", "version": "cd66733932399475fe933cb3ec03e687ed401462", "versionType": "git"}, {"lessThan": "5.4.269", "status": "affected", "version": "5.4.262", "versionType": "semver"}, {"lessThan": "5.10.210", "status": "affected", "version": "5.10.190", "versionType": "semver"}, {"lessThan": "5.15.149", "status": "affected", "version": "5.15.124", "versionType": "semver"}, {"lessThan": "6.1.78", "status": "affected", "version": "6.1.43", "versionType": "semver"}, {"lessThan": "6.5", "status": "affected", "version": "6.4.8", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/netfilter/nft_set_rbtree.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"lessThan": "6.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.269", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.210", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.149", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.78", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.17", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8108978F-ACC3-4DC3-AEC9-E893E980D84A", "versionEndExcluding": "5.4.269", "versionStartIncluding": "5.4.262", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7A162229-E85C-4150-B585-B402CAB87544", "versionEndExcluding": "5.10.210", "versionStartIncluding": "5.10.190", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9396F7D9-F665-4C88-A7EF-4C6AC603DC2F", "versionEndExcluding": "5.15.149", "versionStartIncluding": "5.15.124", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C967F956-2F5A-47ED-BA7B-6868144DD907", "versionEndExcluding": "6.1.78", "versionStartIncluding": "6.1.43", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "78C64F80-8402-4CC8-ABFA-E775538A6F24", "versionEndExcluding": "6.6.17", "versionStartIncluding": "6.4.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "01925741-2C95-47C1-A7EA-3DC2BB0012D3", "versionEndExcluding": "6.7.5", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_rbtree: skip end interval element from gc\n\nrbtree lazy gc on insert might collect an end interval element that has\nbeen just added in this transactions, skip end interval elements that\nare not yet active."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nft_set_rbtree: omitir elemento de intervalo final de gc rbtree lazy gc al insertar puede recopilar un elemento de intervalo final que se acaba de agregar en estas transacciones, omitir elementos de intervalo final que a\u00fan no est\u00e1n activo."}], "id": "CVE-2024-26581", "lastModified": "2026-06-17T07:17:48.980", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-26581", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-10-30T19:31:46.616632Z", "version": "2.0.3"}}]}, "published": "2024-02-20T13:15:09.020", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/10e9cb39313627f2eae4cd70c4b742074e998fd8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1296c110c5a0b45a8fcf58e7d18bc5da61a565cb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2bab493a5624444ec6e648ad0d55a362bcb4c003"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4cee42fcf54fec46b344681e7cc4f234bb22f85a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/60c0c230c6f046da536d3df8b39a20b9a9fd6af0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6eb14441f10602fa1cf691da9d685718b68b78a9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b734f7a47aeb32a5ba298e4ccc16bb0c52b6dbf7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c60d252949caf9aba537525195edae6bbabc35eb"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/10e9cb39313627f2eae4cd70c4b742074e998fd8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1296c110c5a0b45a8fcf58e7d18bc5da61a565cb"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2bab493a5624444ec6e648ad0d55a362bcb4c003"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4cee42fcf54fec46b344681e7cc4f234bb22f85a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/60c0c230c6f046da536d3df8b39a20b9a9fd6af0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6eb14441f10602fa1cf691da9d685718b68b78a9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b734f7a47aeb32a5ba298e4ccc16bb0c52b6dbf7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c60d252949caf9aba537525195edae6bbabc35eb"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:5928", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.33.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-08-28T00:00:00Z"}, {"advisory": "RHSA-2024:5928", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.33.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-08-28T00:00:00Z"}, {"advisory": "RHSA-2024:4823", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "kernel-0:5.14.0-284.75.1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-07-24T00:00:00Z"}, {"advisory": "RHSA-2024:4831", "cpe": "cpe:/a:redhat:rhel_eus:9.2::nfv", "package": "kernel-rt-0:5.14.0-284.75.1.rt14.360.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-07-24T00:00:00Z"}], "bugzilla": {"description": "kernel: nftables: nft_set_rbtree skip end interval element from gc", "id": "2265185", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265185"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnetfilter: nft_set_rbtree: skip end interval element from gc\nrbtree lazy gc on insert might collect an end interval element that has\nbeen just added in this transactions, skip end interval elements that\nare not yet active.", "A flaw was found in the Linux kernel\u2019s Netfilter subsystem. This issue occurs in the nft_set_rbtree. rbtree lazy gc on insert, which might collect an end interval element just added in a transaction and skip the end interval elements not yet active."], "mitigation": {"lang": "en:us", "value": "1. This flaw can be mitigated by preventing the affected netfilter (nf_tables) kernel module from being loaded. For instructions on how to blacklist a kernel module, please see https://access.redhat.com/solutions/41278.\n2. If the module cannot be disabled, on non-containerized deployments of Red Hat Enterprise Linux, the mitigation is to disable user namespaces:\n```\n# echo \"user.max_user_namespaces=0\" > /etc/sysctl.d/userns.conf\n# sysctl -p /etc/sysctl.d/userns.conf\n```\nOn containerized deployments such as Red Hat OpenShift Container Platform, do not use the second mitigation (disabling user namespaces) as the functionality is needed to be enabled. The first mitigation (blacklisting nf_tables) is still viable for containerized deployments, providing the environment is not using netfilter."}, "name": "CVE-2024-26581", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-02-20T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26581\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26581\nhttps://lore.kernel.org/linux-cve-announce/2024022024-uniquely-recluse-d893@gregkh/T/#u"], "statement": "Only privileged user (with access to NetFilter) can trigger this bug. The bug actual only for latest versions of the Red Hat Enterprise Linux 9.", "threat_severity": "Moderate"}

{}