CVE-2024-27012 (GCVE-0-2024-27012)

Vulnerability from cvelistv5 – Published: 2024-05-01 05:29 – Updated: 2026-08-05 11:28
VLAI
Title
netfilter: nf_tables: restore set elements when delete set fails
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: restore set elements when delete set fails From abort path, nft_mapelem_activate() needs to restore refcounters to the original state. Currently, it uses the set->ops->walk() to iterate over these set elements. The existing set iterator skips inactive elements in the next generation, this does not work from the abort path to restore the original state since it has to skip active elements instead (not inactive ones). This patch moves the check for inactive elements to the set iterator callback, then it reverses the logic for the .activate case which needs to skip active elements. Toggle next generation bit for elements when delete set command is invoked and call nft_clear() from .activate (abort) path to restore the next generation bit. The splat below shows an object in mappings memleak: [43929.457523] ------------[ cut here ]------------ [43929.457532] WARNING: CPU: 0 PID: 1139 at include/net/netfilter/nf_tables.h:1237 nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] [...] [43929.458014] RIP: 0010:nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] [43929.458076] Code: 83 f8 01 77 ab 49 8d 7c 24 08 e8 37 5e d0 de 49 8b 6c 24 08 48 8d 7d 50 e8 e9 5c d0 de 8b 45 50 8d 50 ff 89 55 50 85 c0 75 86 <0f> 0b eb 82 0f 0b eb b3 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 [43929.458081] RSP: 0018:ffff888140f9f4b0 EFLAGS: 00010246 [43929.458086] RAX: 0000000000000000 RBX: ffff8881434f5288 RCX: dffffc0000000000 [43929.458090] RDX: 00000000ffffffff RSI: ffffffffa26d28a7 RDI: ffff88810ecc9550 [43929.458093] RBP: ffff88810ecc9500 R08: 0000000000000001 R09: ffffed10281f3e8f [43929.458096] R10: 0000000000000003 R11: ffff0000ffff0000 R12: ffff8881434f52a0 [43929.458100] R13: ffff888140f9f5f4 R14: ffff888151c7a800 R15: 0000000000000002 [43929.458103] FS: 00007f0c687c4740(0000) GS:ffff888390800000(0000) knlGS:0000000000000000 [43929.458107] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [43929.458111] CR2: 00007f58dbe5b008 CR3: 0000000123602005 CR4: 00000000001706f0 [43929.458114] Call Trace: [43929.458118] <TASK> [43929.458121] ? __warn+0x9f/0x1a0 [43929.458127] ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] [43929.458188] ? report_bug+0x1b1/0x1e0 [43929.458196] ? handle_bug+0x3c/0x70 [43929.458200] ? exc_invalid_op+0x17/0x40 [43929.458211] ? nft_setelem_data_deactivate+0xd7/0xf0 [nf_tables] [43929.458271] ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] [43929.458332] nft_mapelem_deactivate+0x24/0x30 [nf_tables] [43929.458392] nft_rhash_walk+0xdd/0x180 [nf_tables] [43929.458453] ? __pfx_nft_rhash_walk+0x10/0x10 [nf_tables] [43929.458512] ? rb_insert_color+0x2e/0x280 [43929.458520] nft_map_deactivate+0xdc/0x1e0 [nf_tables] [43929.458582] ? __pfx_nft_map_deactivate+0x10/0x10 [nf_tables] [43929.458642] ? __pfx_nft_mapelem_deactivate+0x10/0x10 [nf_tables] [43929.458701] ? __rcu_read_unlock+0x46/0x70 [43929.458709] nft_delset+0xff/0x110 [nf_tables] [43929.458769] nft_flush_table+0x16f/0x460 [nf_tables] [43929.458830] nf_tables_deltable+0x501/0x580 [nf_tables]
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 25aa2ad37c2162be1c0bc4fe6397f7e4c13f00f8 , < 2cf64b16ac55c42c8989d8c819e42a77549cd680 (git)
Affected: d60be2da67d172aecf866302c91ea11533eca4d9 , < faa0deee272128b95a838fe7c6ebf6a2a426df14 (git)
Affected: 628bd3e49cba1c066228e23d71a852c23e26da73 , < 86658fc7414d4b9e25c2699d751034537503d637 (git)
Affected: 628bd3e49cba1c066228e23d71a852c23e26da73 , < e79b47a8615d42c68aaeb68971593333667382ed (git)
Affected: bc9f791d2593f17e39f87c6e2b3a36549a3705b1 (git)
Affected: 3c7ec098e3b588434a8b07ea9b5b36f04cef1f50 (git)
Affected: a136b7942ad2a50de708f76ea299ccb45ac7a7f9 (git)
Affected: dc7cdf8cbcbf8b13de1df93f356ec04cdeef5c41 (git)
Affected: 5.15.121 , < 5.15.212 (semver)
Affected: 6.1.36 , < 6.1.176 (semver)
Affected: 4.19.316 , < 4.20 (semver)
Affected: 5.4.262 , < 5.5 (semver)
Affected: 5.10.188 , < 5.11 (semver)
Affected: 6.3.10 , < 6.4 (semver)
Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.8.8 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27012",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-14T18:56:10.473492Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-14T18:56:19.427Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:17:03.442Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/86658fc7414d4b9e25c2699d751034537503d637"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e79b47a8615d42c68aaeb68971593333667382ed"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c",
            "net/netfilter/nft_set_bitmap.c",
            "net/netfilter/nft_set_hash.c",
            "net/netfilter/nft_set_pipapo.c",
            "net/netfilter/nft_set_rbtree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2cf64b16ac55c42c8989d8c819e42a77549cd680",
              "status": "affected",
              "version": "25aa2ad37c2162be1c0bc4fe6397f7e4c13f00f8",
              "versionType": "git"
            },
            {
              "lessThan": "faa0deee272128b95a838fe7c6ebf6a2a426df14",
              "status": "affected",
              "version": "d60be2da67d172aecf866302c91ea11533eca4d9",
              "versionType": "git"
            },
            {
              "lessThan": "86658fc7414d4b9e25c2699d751034537503d637",
              "status": "affected",
              "version": "628bd3e49cba1c066228e23d71a852c23e26da73",
              "versionType": "git"
            },
            {
              "lessThan": "e79b47a8615d42c68aaeb68971593333667382ed",
              "status": "affected",
              "version": "628bd3e49cba1c066228e23d71a852c23e26da73",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bc9f791d2593f17e39f87c6e2b3a36549a3705b1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3c7ec098e3b588434a8b07ea9b5b36f04cef1f50",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a136b7942ad2a50de708f76ea299ccb45ac7a7f9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dc7cdf8cbcbf8b13de1df93f356ec04cdeef5c41",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.212",
              "status": "affected",
              "version": "5.15.121",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.176",
              "status": "affected",
              "version": "6.1.36",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.316",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.262",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.188",
              "versionType": "semver"
            },
            {
              "lessThan": "6.4",
              "status": "affected",
              "version": "6.3.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c",
            "net/netfilter/nft_set_bitmap.c",
            "net/netfilter/nft_set_hash.c",
            "net/netfilter/nft_set_pipapo.c",
            "net/netfilter/nft_set_rbtree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.15.121",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "6.1.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.8",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.316",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.262",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.188",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: restore set elements when delete set fails\n\nFrom abort path, nft_mapelem_activate() needs to restore refcounters to\nthe original state. Currently, it uses the set-\u003eops-\u003ewalk() to iterate\nover these set elements. The existing set iterator skips inactive\nelements in the next generation, this does not work from the abort path\nto restore the original state since it has to skip active elements\ninstead (not inactive ones).\n\nThis patch moves the check for inactive elements to the set iterator\ncallback, then it reverses the logic for the .activate case which\nneeds to skip active elements.\n\nToggle next generation bit for elements when delete set command is\ninvoked and call nft_clear() from .activate (abort) path to restore the\nnext generation bit.\n\nThe splat below shows an object in mappings memleak:\n\n[43929.457523] ------------[ cut here ]------------\n[43929.457532] WARNING: CPU: 0 PID: 1139 at include/net/netfilter/nf_tables.h:1237 nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]\n[...]\n[43929.458014] RIP: 0010:nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]\n[43929.458076] Code: 83 f8 01 77 ab 49 8d 7c 24 08 e8 37 5e d0 de 49 8b 6c 24 08 48 8d 7d 50 e8 e9 5c d0 de 8b 45 50 8d 50 ff 89 55 50 85 c0 75 86 \u003c0f\u003e 0b eb 82 0f 0b eb b3 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90\n[43929.458081] RSP: 0018:ffff888140f9f4b0 EFLAGS: 00010246\n[43929.458086] RAX: 0000000000000000 RBX: ffff8881434f5288 RCX: dffffc0000000000\n[43929.458090] RDX: 00000000ffffffff RSI: ffffffffa26d28a7 RDI: ffff88810ecc9550\n[43929.458093] RBP: ffff88810ecc9500 R08: 0000000000000001 R09: ffffed10281f3e8f\n[43929.458096] R10: 0000000000000003 R11: ffff0000ffff0000 R12: ffff8881434f52a0\n[43929.458100] R13: ffff888140f9f5f4 R14: ffff888151c7a800 R15: 0000000000000002\n[43929.458103] FS:  00007f0c687c4740(0000) GS:ffff888390800000(0000) knlGS:0000000000000000\n[43929.458107] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[43929.458111] CR2: 00007f58dbe5b008 CR3: 0000000123602005 CR4: 00000000001706f0\n[43929.458114] Call Trace:\n[43929.458118]  \u003cTASK\u003e\n[43929.458121]  ? __warn+0x9f/0x1a0\n[43929.458127]  ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]\n[43929.458188]  ? report_bug+0x1b1/0x1e0\n[43929.458196]  ? handle_bug+0x3c/0x70\n[43929.458200]  ? exc_invalid_op+0x17/0x40\n[43929.458211]  ? nft_setelem_data_deactivate+0xd7/0xf0 [nf_tables]\n[43929.458271]  ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]\n[43929.458332]  nft_mapelem_deactivate+0x24/0x30 [nf_tables]\n[43929.458392]  nft_rhash_walk+0xdd/0x180 [nf_tables]\n[43929.458453]  ? __pfx_nft_rhash_walk+0x10/0x10 [nf_tables]\n[43929.458512]  ? rb_insert_color+0x2e/0x280\n[43929.458520]  nft_map_deactivate+0xdc/0x1e0 [nf_tables]\n[43929.458582]  ? __pfx_nft_map_deactivate+0x10/0x10 [nf_tables]\n[43929.458642]  ? __pfx_nft_mapelem_deactivate+0x10/0x10 [nf_tables]\n[43929.458701]  ? __rcu_read_unlock+0x46/0x70\n[43929.458709]  nft_delset+0xff/0x110 [nf_tables]\n[43929.458769]  nft_flush_table+0x16f/0x460 [nf_tables]\n[43929.458830]  nf_tables_deltable+0x501/0x580 [nf_tables]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the nfnetlink socket (NFNL_SUBSYS_NFTABLES batch messages) from a local process; no remote packet processing reaches the buggy transaction/abort logic.\nAC:L - Exploitation is a deterministic, fully attacker-controlled sequence of nftables batch commands (build a verdict/object map, then trigger the non-idempotent set-delete/abort path); there is no race or uncontrolled precondition.\nPR:L - The only gate is netlink_net_capable(CAP_NET_ADMIN), which is checked against the netns-owning user namespace, so an unprivileged user obtains it with `unshare -Urn` and gets full nftables control.\nUI:N - The attacker performs the entire sequence itself via its own netlink socket; no action by any other user is required.\nS:U - The corruption and any resulting privilege escalation stay within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The refcount imbalance lets a chain/object be freed while a live map element still references it, and the resulting use-after-free on a reclaimed slab object yields an arbitrary kernel-memory read primitive.\nI:H - The dangling struct nft_chain is dereferenced by nft_do_chain() on the packet path, giving control over rule/expression function pointers via heap spraying \u2014 a control-flow hijack and arbitrary write primitive.\nA:H - Even without full exploitation the bug produces a WARN/refcount underflow, a permanent unreclaimable object leak, and a use-after-free that reliably oopses or panics the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:28:58.083Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2cf64b16ac55c42c8989d8c819e42a77549cd680"
        },
        {
          "url": "https://git.kernel.org/stable/c/faa0deee272128b95a838fe7c6ebf6a2a426df14"
        },
        {
          "url": "https://git.kernel.org/stable/c/86658fc7414d4b9e25c2699d751034537503d637"
        },
        {
          "url": "https://git.kernel.org/stable/c/e79b47a8615d42c68aaeb68971593333667382ed"
        }
      ],
      "title": "netfilter: nf_tables: restore set elements when delete set fails",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27012",
    "datePublished": "2024-05-01T05:29:37.765Z",
    "dateReserved": "2024-02-19T14:20:24.208Z",
    "dateUpdated": "2026-08-05T11:28:58.083Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-27012",
      "date": "2026-08-05",
      "epss": "0.00272",
      "percentile": "0.19309"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.4\", \"versionEndExcluding\": \"6.8.8\", \"matchCriteriaId\": \"ABBE8A9C-EB49-4236-B78E-D0771D521A7F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"A06B2CCF-3F43-4FA9-8773-C83C3F5764B2\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CC559B26-5DFC-4B7A-A27C-B77DE755DFF9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CA277A6C-83EC-4536-9125-97B84C4FAF59\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nf_tables: restore set elements when delete set fails\\n\\nFrom abort path, nft_mapelem_activate() needs to restore refcounters to\\nthe original state. Currently, it uses the set-\u003eops-\u003ewalk() to iterate\\nover these set elements. The existing set iterator skips inactive\\nelements in the next generation, this does not work from the abort path\\nto restore the original state since it has to skip active elements\\ninstead (not inactive ones).\\n\\nThis patch moves the check for inactive elements to the set iterator\\ncallback, then it reverses the logic for the .activate case which\\nneeds to skip active elements.\\n\\nToggle next generation bit for elements when delete set command is\\ninvoked and call nft_clear() from .activate (abort) path to restore the\\nnext generation bit.\\n\\nThe splat below shows an object in mappings memleak:\\n\\n[43929.457523] ------------[ cut here ]------------\\n[43929.457532] WARNING: CPU: 0 PID: 1139 at include/net/netfilter/nf_tables.h:1237 nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]\\n[...]\\n[43929.458014] RIP: 0010:nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]\\n[43929.458076] Code: 83 f8 01 77 ab 49 8d 7c 24 08 e8 37 5e d0 de 49 8b 6c 24 08 48 8d 7d 50 e8 e9 5c d0 de 8b 45 50 8d 50 ff 89 55 50 85 c0 75 86 \u003c0f\u003e 0b eb 82 0f 0b eb b3 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90\\n[43929.458081] RSP: 0018:ffff888140f9f4b0 EFLAGS: 00010246\\n[43929.458086] RAX: 0000000000000000 RBX: ffff8881434f5288 RCX: dffffc0000000000\\n[43929.458090] RDX: 00000000ffffffff RSI: ffffffffa26d28a7 RDI: ffff88810ecc9550\\n[43929.458093] RBP: ffff88810ecc9500 R08: 0000000000000001 R09: ffffed10281f3e8f\\n[43929.458096] R10: 0000000000000003 R11: ffff0000ffff0000 R12: ffff8881434f52a0\\n[43929.458100] R13: ffff888140f9f5f4 R14: ffff888151c7a800 R15: 0000000000000002\\n[43929.458103] FS:  00007f0c687c4740(0000) GS:ffff888390800000(0000) knlGS:0000000000000000\\n[43929.458107] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[43929.458111] CR2: 00007f58dbe5b008 CR3: 0000000123602005 CR4: 00000000001706f0\\n[43929.458114] Call Trace:\\n[43929.458118]  \u003cTASK\u003e\\n[43929.458121]  ? __warn+0x9f/0x1a0\\n[43929.458127]  ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]\\n[43929.458188]  ? report_bug+0x1b1/0x1e0\\n[43929.458196]  ? handle_bug+0x3c/0x70\\n[43929.458200]  ? exc_invalid_op+0x17/0x40\\n[43929.458211]  ? nft_setelem_data_deactivate+0xd7/0xf0 [nf_tables]\\n[43929.458271]  ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]\\n[43929.458332]  nft_mapelem_deactivate+0x24/0x30 [nf_tables]\\n[43929.458392]  nft_rhash_walk+0xdd/0x180 [nf_tables]\\n[43929.458453]  ? __pfx_nft_rhash_walk+0x10/0x10 [nf_tables]\\n[43929.458512]  ? rb_insert_color+0x2e/0x280\\n[43929.458520]  nft_map_deactivate+0xdc/0x1e0 [nf_tables]\\n[43929.458582]  ? __pfx_nft_map_deactivate+0x10/0x10 [nf_tables]\\n[43929.458642]  ? __pfx_nft_mapelem_deactivate+0x10/0x10 [nf_tables]\\n[43929.458701]  ? __rcu_read_unlock+0x46/0x70\\n[43929.458709]  nft_delset+0xff/0x110 [nf_tables]\\n[43929.458769]  nft_flush_table+0x16f/0x460 [nf_tables]\\n[43929.458830]  nf_tables_deltable+0x501/0x580 [nf_tables]\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: netfilter: nf_tables: restaurar elementos del conjunto cuando falla la eliminaci\\u00f3n del conjunto Desde la ruta de cancelaci\\u00f3n, nft_mapelem_activate() necesita restaurar los contadores de referencia al estado original. Actualmente, utiliza set-\u0026gt;ops-\u0026gt;walk() para iterar sobre estos elementos del conjunto. El iterador de conjunto existente omite elementos inactivos en la pr\\u00f3xima generaci\\u00f3n; esto no funciona desde la ruta de cancelaci\\u00f3n para restaurar el estado original ya que tiene que omitir elementos activos (no inactivos). Este parche mueve la verificaci\\u00f3n de elementos inactivos a la devoluci\\u00f3n de llamada del iterador establecido, luego invierte la l\\u00f3gica para el caso .activate que necesita omitir elementos activos. Cambie el bit de pr\\u00f3xima generaci\\u00f3n para los elementos cuando se invoque el comando eliminar conjunto y llame a nft_clear() desde la ruta .activate (abortar) para restaurar el bit de pr\\u00f3xima generaci\\u00f3n. El siguiente s\\u00edmbolo muestra un objeto en asignaciones memleak: [43929.457523] ------------[ cortar aqu\\u00ed ]------------ [43929.457532] ADVERTENCIA: CPU: 0 PID : 1139 en include/net/netfilter/nf_tables.h:1237 nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] [...] [43929.458014] RIP: 0010:nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] ] C\\u00f3digo: 83 f8 01 77 ab 49 8d 7c 24 08 e8 37 5e d0 de 49 8b 6c 24 08 48 8d 7d 50 e8 e9 5c d0 de 8b 45 50 8d 50 ff 89 55 50 85 c0 75 86 \u0026lt;0f\u0026gt; 0b eb 82 0f 0b eb b3 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 [43929.458081] RSP: 0018:ffff888140f9f4b0 EFLAGS: 00010246 [43929.458086] RAX: 000000000000000 0 RBX: ffff8881434f5288 RCX: dffffc0000000000 [43929.458090] RDX: 00000000ffffffff RSI: ffffffffa26d28a7 RDI: ffff88810ecc9550 [43929.458093 ] RBP: ffff88810ecc9500 R08: 0000000000000001 R09: ffffed10281f3e8f [43929.458096] R10: 00000000000000003 R11: ffff0000ffff0000 R12: 4f52a0 [43929.458100] R13: ffff888140f9f5f4 R14: ffff888151c7a800 R15: 0000000000000002 [43929.458103] FS: 00007f0c687c4740(0000) 88390800000(0000) knlGS :0000000000000000 [43929.458107] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [43929.458111] CR2: 00007f58dbe5b008 CR3: 00000001236020 05 CR4: 00000000001706f0 [43929.458114] Seguimiento de llamadas: [43929.458118]  [43929.458121] ? __advertir+0x9f/0x1a0 [43929.458127] ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] [43929.458188] ? report_bug+0x1b1/0x1e0 [43929.458196] ? handle_bug+0x3c/0x70 [43929.458200] ? exc_invalid_op+0x17/0x40 [43929.458211] ? nft_setelem_data_deactivate+0xd7/0xf0 [nf_tables] [43929.458271] ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] [43929.458332] nft_mapelem_deactivate+0x24/0x30 [nf_tables] [43929.458392] nft_rhash_walk+0xdd/0x180 [nf_tables] 53] ? __pfx_nft_rhash_walk+0x10/0x10 [nf_tables] [43929.458512] ? rb_insert_color+0x2e/0x280 [43929.458520] nft_map_deactivate+0xdc/0x1e0 [nf_tables] [43929.458582] ? __pfx_nft_map_deactivate+0x10/0x10 [nf_tables] [43929.458642] ? __pfx_nft_mapelem_deactivate+0x10/0x10 [nf_tables] [43929.458701] ? __rcu_read_unlock+0x46/0x70 [43929.458709] nft_delset+0xff/0x110 [nf_tables] [43929.458769] nft_flush_table+0x16f/0x460 [nf_tables] [43929.458830] 501/0x580 [nf_tables]\"}]",
      "id": "CVE-2024-27012",
      "lastModified": "2024-12-27T13:15:18.897",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-05-01T06:15:19.743",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/86658fc7414d4b9e25c2699d751034537503d637\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e79b47a8615d42c68aaeb68971593333667382ed\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/86658fc7414d4b9e25c2699d751034537503d637\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e79b47a8615d42c68aaeb68971593333667382ed\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-401\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-19T01:40:21.000Z",
      "cve": "CVE-2024-27012",
      "id": "msrc_CVE-2024-27012",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "netfilter: nf_tables: restore set elements when delete set fails",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-27012.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-27012\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-01T06:15:19.743\",\"lastModified\":\"2026-08-04T11:17:33.100\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nf_tables: restore set elements when delete set fails\\n\\nFrom abort path, nft_mapelem_activate() needs to restore refcounters to\\nthe original state. Currently, it uses the set-\u003eops-\u003ewalk() to iterate\\nover these set elements. The existing set iterator skips inactive\\nelements in the next generation, this does not work from the abort path\\nto restore the original state since it has to skip active elements\\ninstead (not inactive ones).\\n\\nThis patch moves the check for inactive elements to the set iterator\\ncallback, then it reverses the logic for the .activate case which\\nneeds to skip active elements.\\n\\nToggle next generation bit for elements when delete set command is\\ninvoked and call nft_clear() from .activate (abort) path to restore the\\nnext generation bit.\\n\\nThe splat below shows an object in mappings memleak:\\n\\n[43929.457523] ------------[ cut here ]------------\\n[43929.457532] WARNING: CPU: 0 PID: 1139 at include/net/netfilter/nf_tables.h:1237 nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]\\n[...]\\n[43929.458014] RIP: 0010:nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]\\n[43929.458076] Code: 83 f8 01 77 ab 49 8d 7c 24 08 e8 37 5e d0 de 49 8b 6c 24 08 48 8d 7d 50 e8 e9 5c d0 de 8b 45 50 8d 50 ff 89 55 50 85 c0 75 86 \u003c0f\u003e 0b eb 82 0f 0b eb b3 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90\\n[43929.458081] RSP: 0018:ffff888140f9f4b0 EFLAGS: 00010246\\n[43929.458086] RAX: 0000000000000000 RBX: ffff8881434f5288 RCX: dffffc0000000000\\n[43929.458090] RDX: 00000000ffffffff RSI: ffffffffa26d28a7 RDI: ffff88810ecc9550\\n[43929.458093] RBP: ffff88810ecc9500 R08: 0000000000000001 R09: ffffed10281f3e8f\\n[43929.458096] R10: 0000000000000003 R11: ffff0000ffff0000 R12: ffff8881434f52a0\\n[43929.458100] R13: ffff888140f9f5f4 R14: ffff888151c7a800 R15: 0000000000000002\\n[43929.458103] FS:  00007f0c687c4740(0000) GS:ffff888390800000(0000) knlGS:0000000000000000\\n[43929.458107] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[43929.458111] CR2: 00007f58dbe5b008 CR3: 0000000123602005 CR4: 00000000001706f0\\n[43929.458114] Call Trace:\\n[43929.458118]  \u003cTASK\u003e\\n[43929.458121]  ? __warn+0x9f/0x1a0\\n[43929.458127]  ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]\\n[43929.458188]  ? report_bug+0x1b1/0x1e0\\n[43929.458196]  ? handle_bug+0x3c/0x70\\n[43929.458200]  ? exc_invalid_op+0x17/0x40\\n[43929.458211]  ? nft_setelem_data_deactivate+0xd7/0xf0 [nf_tables]\\n[43929.458271]  ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]\\n[43929.458332]  nft_mapelem_deactivate+0x24/0x30 [nf_tables]\\n[43929.458392]  nft_rhash_walk+0xdd/0x180 [nf_tables]\\n[43929.458453]  ? __pfx_nft_rhash_walk+0x10/0x10 [nf_tables]\\n[43929.458512]  ? rb_insert_color+0x2e/0x280\\n[43929.458520]  nft_map_deactivate+0xdc/0x1e0 [nf_tables]\\n[43929.458582]  ? __pfx_nft_map_deactivate+0x10/0x10 [nf_tables]\\n[43929.458642]  ? __pfx_nft_mapelem_deactivate+0x10/0x10 [nf_tables]\\n[43929.458701]  ? __rcu_read_unlock+0x46/0x70\\n[43929.458709]  nft_delset+0xff/0x110 [nf_tables]\\n[43929.458769]  nft_flush_table+0x16f/0x460 [nf_tables]\\n[43929.458830]  nf_tables_deltable+0x501/0x580 [nf_tables]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: netfilter: nf_tables: restaurar elementos del conjunto cuando falla la eliminaci\u00f3n del conjunto Desde la ruta de cancelaci\u00f3n, nft_mapelem_activate() necesita restaurar los contadores de referencia al estado original. Actualmente, utiliza set-\u0026gt;ops-\u0026gt;walk() para iterar sobre estos elementos del conjunto. El iterador de conjunto existente omite elementos inactivos en la pr\u00f3xima generaci\u00f3n; esto no funciona desde la ruta de cancelaci\u00f3n para restaurar el estado original ya que tiene que omitir elementos activos (no inactivos). Este parche mueve la verificaci\u00f3n de elementos inactivos a la devoluci\u00f3n de llamada del iterador establecido, luego invierte la l\u00f3gica para el caso .activate que necesita omitir elementos activos. Cambie el bit de pr\u00f3xima generaci\u00f3n para los elementos cuando se invoque el comando eliminar conjunto y llame a nft_clear() desde la ruta .activate (abortar) para restaurar el bit de pr\u00f3xima generaci\u00f3n. El siguiente s\u00edmbolo muestra un objeto en asignaciones memleak: [43929.457523] ------------[ cortar aqu\u00ed ]------------ [43929.457532] ADVERTENCIA: CPU: 0 PID : 1139 en include/net/netfilter/nf_tables.h:1237 nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] [...] [43929.458014] RIP: 0010:nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] ] C\u00f3digo: 83 f8 01 77 ab 49 8d 7c 24 08 e8 37 5e d0 de 49 8b 6c 24 08 48 8d 7d 50 e8 e9 5c d0 de 8b 45 50 8d 50 ff 89 55 50 85 c0 75 86 \u0026lt;0f\u0026gt; 0b eb 82 0f 0b eb b3 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 [43929.458081] RSP: 0018:ffff888140f9f4b0 EFLAGS: 00010246 [43929.458086] RAX: 000000000000000 0 RBX: ffff8881434f5288 RCX: dffffc0000000000 [43929.458090] RDX: 00000000ffffffff RSI: ffffffffa26d28a7 RDI: ffff88810ecc9550 [43929.458093 ] RBP: ffff88810ecc9500 R08: 0000000000000001 R09: ffffed10281f3e8f [43929.458096] R10: 00000000000000003 R11: ffff0000ffff0000 R12: 4f52a0 [43929.458100] R13: ffff888140f9f5f4 R14: ffff888151c7a800 R15: 0000000000000002 [43929.458103] FS: 00007f0c687c4740(0000) 88390800000(0000) knlGS :0000000000000000 [43929.458107] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [43929.458111] CR2: 00007f58dbe5b008 CR3: 00000001236020 05 CR4: 00000000001706f0 [43929.458114] Seguimiento de llamadas: [43929.458118]  [43929.458121] ? __advertir+0x9f/0x1a0 [43929.458127] ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] [43929.458188] ? report_bug+0x1b1/0x1e0 [43929.458196] ? handle_bug+0x3c/0x70 [43929.458200] ? exc_invalid_op+0x17/0x40 [43929.458211] ? nft_setelem_data_deactivate+0xd7/0xf0 [nf_tables] [43929.458271] ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] [43929.458332] nft_mapelem_deactivate+0x24/0x30 [nf_tables] [43929.458392] nft_rhash_walk+0xdd/0x180 [nf_tables] 53] ? __pfx_nft_rhash_walk+0x10/0x10 [nf_tables] [43929.458512] ? rb_insert_color+0x2e/0x280 [43929.458520] nft_map_deactivate+0xdc/0x1e0 [nf_tables] [43929.458582] ? __pfx_nft_map_deactivate+0x10/0x10 [nf_tables] [43929.458642] ? __pfx_nft_mapelem_deactivate+0x10/0x10 [nf_tables] [43929.458701] ? __rcu_read_unlock+0x46/0x70 [43929.458709] nft_delset+0xff/0x110 [nf_tables] [43929.458769] nft_flush_table+0x16f/0x460 [nf_tables] [43929.458830] 501/0x580 [nf_tables]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/netfilter/nf_tables_api.c\",\"net/netfilter/nft_set_bitmap.c\",\"net/netfilter/nft_set_hash.c\",\"net/netfilter/nft_set_pipapo.c\",\"net/netfilter/nft_set_rbtree.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"25aa2ad37c2162be1c0bc4fe6397f7e4c13f00f8\",\"lessThan\":\"2cf64b16ac55c42c8989d8c819e42a77549cd680\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d60be2da67d172aecf866302c91ea11533eca4d9\",\"lessThan\":\"faa0deee272128b95a838fe7c6ebf6a2a426df14\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"628bd3e49cba1c066228e23d71a852c23e26da73\",\"lessThan\":\"86658fc7414d4b9e25c2699d751034537503d637\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"628bd3e49cba1c066228e23d71a852c23e26da73\",\"lessThan\":\"e79b47a8615d42c68aaeb68971593333667382ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bc9f791d2593f17e39f87c6e2b3a36549a3705b1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3c7ec098e3b588434a8b07ea9b5b36f04cef1f50\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a136b7942ad2a50de708f76ea299ccb45ac7a7f9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dc7cdf8cbcbf8b13de1df93f356ec04cdeef5c41\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.15.121\",\"lessThan\":\"5.15.212\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.36\",\"lessThan\":\"6.1.176\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.316\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.262\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.188\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.3.10\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/netfilter/nf_tables_api.c\",\"net/netfilter/nft_set_bitmap.c\",\"net/netfilter/nft_set_hash.c\",\"net/netfilter/nft_set_pipapo.c\",\"net/netfilter/nft_set_rbtree.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.212\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.176\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.8\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-14T18:56:10.473492Z\",\"id\":\"CVE-2024-27012\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4\",\"versionEndExcluding\":\"6.8.8\",\"matchCriteriaId\":\"ABBE8A9C-EB49-4236-B78E-D0771D521A7F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A06B2CCF-3F43-4FA9-8773-C83C3F5764B2\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CC559B26-5DFC-4B7A-A27C-B77DE755DFF9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA277A6C-83EC-4536-9125-97B84C4FAF59\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2cf64b16ac55c42c8989d8c819e42a77549cd680\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/86658fc7414d4b9e25c2699d751034537503d637\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e79b47a8615d42c68aaeb68971593333667382ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/faa0deee272128b95a838fe7c6ebf6a2a426df14\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/86658fc7414d4b9e25c2699d751034537503d637\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e79b47a8615d42c68aaeb68971593333667382ed\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:48:31+00:00",
      "cve": "CVE-2024-27012",
      "id": "CVE-2024-27012",
      "initial_release_date": "2024-05-01T00:00:00+00:00",
      "product_status:fixed": "559",
      "product_status:known_affected": "50",
      "product_status:known_not_affected": "146",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: nf_tables: restore set elements when delete set fails",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-27012.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-23T02:08:10Z",
      "cve": "CVE-2024-27012",
      "id": "CVE-2024-27012",
      "initial_release_date": "2024-05-04T02:23:14Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "312",
      "product_status:recommended": "358",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-27012",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-27012.json",
      "version": "74"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/86658fc7414d4b9e25c2699d751034537503d637\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e79b47a8615d42c68aaeb68971593333667382ed\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T17:17:03.442Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-27012\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-14T18:56:10.473492Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-14T18:56:15.272Z\"}}], \"cna\": {\"title\": \"netfilter: nf_tables: restore set elements when delete set fails\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"25aa2ad37c2162be1c0bc4fe6397f7e4c13f00f8\", \"lessThan\": \"2cf64b16ac55c42c8989d8c819e42a77549cd680\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d60be2da67d172aecf866302c91ea11533eca4d9\", \"lessThan\": \"faa0deee272128b95a838fe7c6ebf6a2a426df14\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"628bd3e49cba1c066228e23d71a852c23e26da73\", \"lessThan\": \"86658fc7414d4b9e25c2699d751034537503d637\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"628bd3e49cba1c066228e23d71a852c23e26da73\", \"lessThan\": \"e79b47a8615d42c68aaeb68971593333667382ed\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bc9f791d2593f17e39f87c6e2b3a36549a3705b1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3c7ec098e3b588434a8b07ea9b5b36f04cef1f50\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a136b7942ad2a50de708f76ea299ccb45ac7a7f9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"dc7cdf8cbcbf8b13de1df93f356ec04cdeef5c41\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.15.121\", \"lessThan\": \"5.15.212\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.1.36\", \"lessThan\": \"6.1.176\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.19.316\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.4.262\", \"lessThan\": \"5.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.10.188\", \"lessThan\": \"5.11\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.3.10\", \"lessThan\": \"6.4\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/netfilter/nf_tables_api.c\", \"net/netfilter/nft_set_bitmap.c\", \"net/netfilter/nft_set_hash.c\", \"net/netfilter/nft_set_pipapo.c\", \"net/netfilter/nft_set_rbtree.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.212\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.176\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/netfilter/nf_tables_api.c\", \"net/netfilter/nft_set_bitmap.c\", \"net/netfilter/nft_set_hash.c\", \"net/netfilter/nft_set_pipapo.c\", \"net/netfilter/nft_set_rbtree.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2cf64b16ac55c42c8989d8c819e42a77549cd680\"}, {\"url\": \"https://git.kernel.org/stable/c/faa0deee272128b95a838fe7c6ebf6a2a426df14\"}, {\"url\": \"https://git.kernel.org/stable/c/86658fc7414d4b9e25c2699d751034537503d637\"}, {\"url\": \"https://git.kernel.org/stable/c/e79b47a8615d42c68aaeb68971593333667382ed\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nf_tables: restore set elements when delete set fails\\n\\nFrom abort path, nft_mapelem_activate() needs to restore refcounters to\\nthe original state. Currently, it uses the set-\u003eops-\u003ewalk() to iterate\\nover these set elements. The existing set iterator skips inactive\\nelements in the next generation, this does not work from the abort path\\nto restore the original state since it has to skip active elements\\ninstead (not inactive ones).\\n\\nThis patch moves the check for inactive elements to the set iterator\\ncallback, then it reverses the logic for the .activate case which\\nneeds to skip active elements.\\n\\nToggle next generation bit for elements when delete set command is\\ninvoked and call nft_clear() from .activate (abort) path to restore the\\nnext generation bit.\\n\\nThe splat below shows an object in mappings memleak:\\n\\n[43929.457523] ------------[ cut here ]------------\\n[43929.457532] WARNING: CPU: 0 PID: 1139 at include/net/netfilter/nf_tables.h:1237 nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]\\n[...]\\n[43929.458014] RIP: 0010:nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]\\n[43929.458076] Code: 83 f8 01 77 ab 49 8d 7c 24 08 e8 37 5e d0 de 49 8b 6c 24 08 48 8d 7d 50 e8 e9 5c d0 de 8b 45 50 8d 50 ff 89 55 50 85 c0 75 86 \u003c0f\u003e 0b eb 82 0f 0b eb b3 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90\\n[43929.458081] RSP: 0018:ffff888140f9f4b0 EFLAGS: 00010246\\n[43929.458086] RAX: 0000000000000000 RBX: ffff8881434f5288 RCX: dffffc0000000000\\n[43929.458090] RDX: 00000000ffffffff RSI: ffffffffa26d28a7 RDI: ffff88810ecc9550\\n[43929.458093] RBP: ffff88810ecc9500 R08: 0000000000000001 R09: ffffed10281f3e8f\\n[43929.458096] R10: 0000000000000003 R11: ffff0000ffff0000 R12: ffff8881434f52a0\\n[43929.458100] R13: ffff888140f9f5f4 R14: ffff888151c7a800 R15: 0000000000000002\\n[43929.458103] FS:  00007f0c687c4740(0000) GS:ffff888390800000(0000) knlGS:0000000000000000\\n[43929.458107] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[43929.458111] CR2: 00007f58dbe5b008 CR3: 0000000123602005 CR4: 00000000001706f0\\n[43929.458114] Call Trace:\\n[43929.458118]  \u003cTASK\u003e\\n[43929.458121]  ? __warn+0x9f/0x1a0\\n[43929.458127]  ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]\\n[43929.458188]  ? report_bug+0x1b1/0x1e0\\n[43929.458196]  ? handle_bug+0x3c/0x70\\n[43929.458200]  ? exc_invalid_op+0x17/0x40\\n[43929.458211]  ? nft_setelem_data_deactivate+0xd7/0xf0 [nf_tables]\\n[43929.458271]  ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]\\n[43929.458332]  nft_mapelem_deactivate+0x24/0x30 [nf_tables]\\n[43929.458392]  nft_rhash_walk+0xdd/0x180 [nf_tables]\\n[43929.458453]  ? __pfx_nft_rhash_walk+0x10/0x10 [nf_tables]\\n[43929.458512]  ? rb_insert_color+0x2e/0x280\\n[43929.458520]  nft_map_deactivate+0xdc/0x1e0 [nf_tables]\\n[43929.458582]  ? __pfx_nft_map_deactivate+0x10/0x10 [nf_tables]\\n[43929.458642]  ? __pfx_nft_mapelem_deactivate+0x10/0x10 [nf_tables]\\n[43929.458701]  ? __rcu_read_unlock+0x46/0x70\\n[43929.458709]  nft_delset+0xff/0x110 [nf_tables]\\n[43929.458769]  nft_flush_table+0x16f/0x460 [nf_tables]\\n[43929.458830]  nf_tables_deltable+0x501/0x580 [nf_tables]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.212\", \"versionStartIncluding\": \"5.15.121\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.176\", \"versionStartIncluding\": \"6.1.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.8\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.19.316\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.4.262\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.10.188\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.3.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-04T09:21:52.463Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-27012\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-04T09:21:52.463Z\", \"dateReserved\": \"2024-02-19T14:20:24.208Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-01T05:29:37.765Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.