HighFix available
netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with timeouts while it is being released from the commit path. Mingi Cho originally reported this issue in a different path in 6.1.x with a pipapo set with low timeouts which is not possible upstream since 7395dfacfff6 ("netfilter: nf_tables: use timestamp to check for set element timeout"). Fix this by setting on the dead flag for anonymous sets to skip async gc in this case. According to 08e4c8c5919f ("netfilter: nf_tables: mark newset as dead on transaction abort"), Florian plans to accelerate abort path by releasing objects via workqueue, therefore, this sets on the dead flag for abort path too.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.215, 5.15.154, 5.4.274, 6.1.84, 6.6.24, 6.7.12
- CVEs
- CVE-2024-26643
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 16:14 UTC · Revision 1
Source evidence
netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
core-osv · Original sourcePublished 21 Mar 2024, 10:43 UTC
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with timeouts while it is being released from the commit path. Mingi Cho originally reported this issue in a different path in 6.1.x with a pipapo set with low timeouts which is not possible upstream since 7395dfacfff6 ("netfilter: nf_tables: use timestamp to check for set element timeout"). Fix this by setting on the dead flag for anonymous sets to skip async gc in this case. According to 08e4c8c5919f ("netfilter: nf_tables: mark newset as dead on transaction abort"), Florian plans to accelerate abort path by releasing objects via workqueue, therefore, this sets on the dead flag for abort path too.
osv:CVE-2024-26643
Kernel
Fixed versions: 5.4.274, 5.10.215, 5.15.154, 6.1.84, 6.6.24, 6.7.12
Complete source record
{
"id": "9afe23a55673a037e355ecf571e83c3087a872e1c9deb57cc375b07392ca3b38",
"url": "https://osv.dev/vulnerability/CVE-2024-26643",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout",
"summary": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with timeouts while it is being released from the commit path. Mingi Cho originally reported this issue in a different path in 6.1.x with a pipapo set with low timeouts which is not possible upstream since 7395dfacfff6 (\"netfilter: nf_tables: use timestamp to check for set element timeout\"). Fix this by setting on the dead flag for anonymous sets to skip async gc in this case. According to 08e4c8c5919f (\"netfilter: nf_tables: mark newset as dead on transaction abort\"), Florian plans to accelerate abort path by releasing objects via workqueue, therefore, this sets on the dead flag for abort path too.",
"evidence": "osv:CVE-2024-26643",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.4.274",
"evidence": "/affected/1/ranges"
},
{
"value": "5.10.215",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.154",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.84",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.24",
"evidence": "/affected/1/ranges"
},
{
"value": "6.7.12",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2024-26643",
"aliases": [
"CVE-2024-26643"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "8da1b048f9a501d3d7d38c188ba09d7d0d5b8c27"
},
{
"fixed": "d75a589bb92af1abf3b779cfcd1977ca11b27033"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "bbdb3b65aa91aa0a32b212f27780b28987f2d94f"
},
{
"fixed": "edcf1a3f182ecf8b6b805f0ce90570ea98c5f6bf"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "448be0774882f95a74fa5eb7519761152add601b"
},
{
"fixed": "e2d45f467096e931044f0ab7634499879d851a5c"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "d19e8bf3ea4114dd21fc35da21f398203d7f7df1"
},
{
"fixed": "291cca35818bd52a407bc37ab45a15816039e363"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "ea3eb9f2192e4fc33b795673e56c97a21987f868"
},
{
"fixed": "406b0241d0eb598a0b330ab20ae325537d8d8163"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5f68718b34a531a556f2f50300ead2862278da26"
},
{
"fixed": "b2d6f9a5b1cf968f1eaa71085ceeb09c2cb276b1"
},
{
"fixed": "5224afbc30c3ca9ba23e752f0f138729b2c48dd8"
},
{
"fixed": "552705a3650bbf46a22b1adedc1b04181490fc36"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.4.262"
},
{
"fixed": "5.4.274"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.10.198"
},
{
"fixed": "5.10.215"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.15.134"
},
{
"fixed": "5.15.154"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.1.56"
},
{
"fixed": "6.1.84"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.4.11"
},
{
"fixed": "6.5"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "0624f190b5742a1527cd938295caa8dc5281d4cd"
}
]
}
],
"versions": [
"v5.4.273",
"v5.4.272",
"v5.4.271",
"v5.4.270",
"v5.4.269",
"v5.4.268",
"v5.4.267",
"v5.4.266",
"v5.4.265",
"v5.4.264",
"v5.4.263",
"v5.4.262",
"v5.10.214",
"v5.10.213",
"v5.10.212",
"v5.10.211",
"v5.10.210",
"v5.10.209",
"v5.10.208",
"v5.10.207",
"v5.10.206",
"v5.10.205",
"v5.10.204",
"v5.10.203",
"v5.10.202",
"v5.10.201",
"v5.10.200",
"v5.10.199",
"v5.10.198",
"v5.15.153",
"v5.15.152",
"v5.15.151",
"v5.15.150",
"v5.15.149",
"v5.15.148",
"v5.15.147",
"v5.15.146",
"v5.15.145",
"v5.15.144",
"v5.15.143",
"v5.15.142",
"v5.15.141",
"v5.15.140",
"v5.15.139",
"v5.15.138",
"v5.15.137",
"v5.15.136",
"v5.15.135",
"v5.15.134",
"v6.1.83",
"v6.1.82",
"v6.1.81",
"v6.1.80",
"v6.1.79",
"v6.1.78",
"v6.1.77",
"v6.1.76",
"v6.1.75",
"v6.1.74",
"v6.1.73",
"v6.1.72",
"v6.1.71",
"v6.1.70",
"v6.1.69",
"v6.1.68",
"v6.1.67",
"v6.1.66",
"v6.1.65",
"v6.1.64",
"v6.1.63",
"v6.1.62",
"v6.1.61",
"v6.1.60",
"v6.1.59",
"v6.1.58",
"v6.1.57",
"v6.1.56",
"v6.4.16",
"v6.4.15",
"v6.4.14",
"v6.4.13",
"v6.4.12",
"v6.4.11"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26643.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.4.274"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.5.0"
},
{
"fixed": "5.10.215"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.154"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.84"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.24"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.5.0"
},
{
"fixed": "6.7.12"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26643.json"
}
}
],
"modified": "2026-10-28T02:30:37.604296618Z",
"provider": "osv",
"references": [
"https://cert-portal.siemens.com/productcert/html/ssa-265688.html",
"https://git.kernel.org/stable/c/291cca35818bd52a407bc37ab45a15816039e363",
"https://git.kernel.org/stable/c/406b0241d0eb598a0b330ab20ae325537d8d8163",
"https://git.kernel.org/stable/c/5224afbc30c3ca9ba23e752f0f138729b2c48dd8",
"https://git.kernel.org/stable/c/552705a3650bbf46a22b1adedc1b04181490fc36",
"https://git.kernel.org/stable/c/b2d6f9a5b1cf968f1eaa71085ceeb09c2cb276b1",
"https://git.kernel.org/stable/c/d75a589bb92af1abf3b779cfcd1977ca11b27033",
"https://git.kernel.org/stable/c/e2d45f467096e931044f0ab7634499879d851a5c",
"https://git.kernel.org/stable/c/edcf1a3f182ecf8b6b805f0ce90570ea98c5f6bf",
"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26643.json",
"https://nvd.nist.gov/vuln/detail/CVE-2024-26643",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26643.json"
}
},
"related_cves": [
{
"value": "CVE-2024-26643",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 504546,
"published_at": "2024-03-21T10:43:44.103+00:00"
}