VYPR
← All advisories
Medium severity5.5NVD Advisory· Published May 19, 2024· Updated May 12, 2026

CVE-2024-35897

CVE-2024-35897

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: discard table flag update with pending basechain deletion

Hook unregistration is deferred to the commit phase, same occurs with hook updates triggered by the table dormant flag. When both commands are combined, this results in deleting a basechain while leaving its hook still registered in the core.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel's netfilter, combining a table flag update with a pending basechain deletion can leave a hook registered after chain deletion, causing a use-after-free.

Vulnerability

Description

CVE-2024-35897 is a vulnerability in the Linux kernel's netfilter subsystem, specifically in nf_tables. The root cause is that hook unregistration is deferred to the commit phase, and similarly, hook updates triggered by the table dormant flag are also deferred. When both a table flag update (e.g., setting the table dormant) and a basechain deletion are combined in the same transaction, the deletion of the basechain occurs while its hook remains registered in the core, leading to a dangling hook pointer [1].

Exploitation

An attacker with the ability to issue netfilter commands (requiring CAP_NET_ADMIN) can craft a transaction that includes both a table flag update and a basechain deletion. The improper ordering or race condition causes the hook to persist after the chain is freed. This can be triggered locally, and the attack surface is limited to users with sufficient privileges to manipulate netfilter rules.

Impact

The dangling hook can lead to a use-after-free condition when the hook is later invoked by the networking stack. This could allow an attacker to cause a denial of service (system crash) or potentially escalate privileges. The CVSS v3 score is 5.5 (Medium), reflecting the need for local access and high privileges, but with the possibility of high impact on confidentiality, integrity, and availability.

Mitigation

The fix involves discarding the table flag update when there is a pending basechain deletion, ensuring the hook is properly unregistered before the chain is freed. Patches have been applied to the Linux kernel stable branches [2][3][4]. Users should update to a patched kernel version. The Siemens advisory [1] lists affected products, including SIMATIC S7-1500 TM MFP - GNU/Linux subsystem, which are impacted by this and other CVEs.

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

160

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

10

News mentions

0

No linked articles in our index yet.