CVE-2024-26809: netfilter: nft_set_pipapo: release elements in clone only from destroy path

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-04 · updated 2026-08-04

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: release elements in clone only from destroy path Clone already always provides a current view of the lookup table, use it to destroy the set, otherwise it is possible to destroy elements twice. This fix requires: 212ed75dc5fb ("netfilter: nf_tables: integrate pipapo into commit protocol") which came after: 9827a0e6e23b ("netfilter: nft_set_pipapo: release elements in clone from abort path").

Affected products

Debian Linux: 10.0
Linux kernel: from 5.10.130 before 5.10.214; from 5.15.54 before 5.15.153; from 5.18.11 before 6.1.83; from 6.2 before 6.6.23; from 6.7 before 6.7.11; from 6.8 before 6.8.2 — fixed in 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2

How to fix

Upgrade to a fixed version: Linux kernel 5.10.214, 5.15.153, 6.1.83, 6.6.23. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-26809 or the next vulnerability affects your stack