CVE-2024-27020

netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()

State: Published
Severity: 7.8 High
Published: May 1, 2024
Updated: Oct 15, 2026
Reserved: Feb 19, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()

nft_unregister_expr() can concurrent with __nft_expr_type_get(), and there is not any protection when iterate over nf_tables_expressions list in __nft_expr_type_get(). Therefore, there is potential data-race of nf_tables_expressions list entry.

Use list_for_each_entry_rcu() to iterate over nf_tables_expressions list in __nft_expr_type_get(), and use rcu_read_lock() in the caller nft_expr_type_get() to protect the entire type query process.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	ef1f7df9170dbd875ce198ba84e6ab80f6fc139e to before 939109c0a8e2a006a6cc8209e262d25065f4403aAffected ef1f7df9170dbd875ce198ba84e6ab80f6fc139e to before b38a133d37fa421c8447b383d788c9cc6f5cb34cAffected ef1f7df9170dbd875ce198ba84e6ab80f6fc139e to before 934e66e231cff2b18faa2c8aad0b8cec13957e05Affected ef1f7df9170dbd875ce198ba84e6ab80f6fc139e to before 0b6de00206adbbfc6373b3ae38d2a6f197987907Affected ef1f7df9170dbd875ce198ba84e6ab80f6fc139e to before 8d56bad42ac4c43c6c72ddd6a654a2628bf839c5Affected ef1f7df9170dbd875ce198ba84e6ab80f6fc139e to before a9ebf340d123ae12582210407f879d6a5a1bc25bAffected ef1f7df9170dbd875ce198ba84e6ab80f6fc139e to before 01f1a678b05ade4b1248019c2dcca773aebbeb7fAffected ef1f7df9170dbd875ce198ba84e6ab80f6fc139e to before f969eb84ce482331a991079ab7a5c4dc3b7f89bfAffected
LinuxLinux	3.13Affected before 3.13Not affected 4.19.313 through 4.19.Not affected 5.4.275 through 5.4.Not affected 5.10.216 through 5.10.Not affected 5.15.157 through 5.15.Not affected 6.1.88 through 6.1.Not affected 6.6.29 through 6.6.Not affected 6.8.8 through 6.8.*Not affected 6.9 and laterNot affected

Product

Versions

LinuxLinux

ef1f7df9170dbd875ce198ba84e6ab80f6fc139e to before 939109c0a8e2a006a6cc8209e262d25065f4403aAffected
ef1f7df9170dbd875ce198ba84e6ab80f6fc139e to before b38a133d37fa421c8447b383d788c9cc6f5cb34cAffected
ef1f7df9170dbd875ce198ba84e6ab80f6fc139e to before 934e66e231cff2b18faa2c8aad0b8cec13957e05Affected
ef1f7df9170dbd875ce198ba84e6ab80f6fc139e to before 0b6de00206adbbfc6373b3ae38d2a6f197987907Affected
ef1f7df9170dbd875ce198ba84e6ab80f6fc139e to before 8d56bad42ac4c43c6c72ddd6a654a2628bf839c5Affected
ef1f7df9170dbd875ce198ba84e6ab80f6fc139e to before a9ebf340d123ae12582210407f879d6a5a1bc25bAffected
ef1f7df9170dbd875ce198ba84e6ab80f6fc139e to before 01f1a678b05ade4b1248019c2dcca773aebbeb7fAffected
ef1f7df9170dbd875ce198ba84e6ab80f6fc139e to before f969eb84ce482331a991079ab7a5c4dc3b7f89bfAffected

LinuxLinux

3.13Affected
before 3.13Not affected
4.19.313 through 4.19.*Not affected
5.4.275 through 5.4.*Not affected
5.10.216 through 5.10.*Not affected
5.15.157 through 5.15.*Not affected
6.1.88 through 6.1.*Not affected
6.6.29 through 6.6.*Not affected
6.8.8 through 6.8.*Not affected
6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.