VYPR
← All advisories
Medium severity5.5NVD Advisory· Published May 19, 2024· Updated May 12, 2026

CVE-2024-35900

CVE-2024-35900

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: reject new basechain after table flag update

When dormant flag is toggled, hooks are disabled in the commit phase by iterating over current chains in table (existing and new).

The following configuration allows for an inconsistent state:

add table x add chain x y { type filter hook input priority 0; } add table x { flags dormant; } add chain x w { type filter hook input priority 1; }

which triggers the following warning when trying to unregister chain w which is already unregistered.

[ 127.322252] WARNING: CPU: 7 PID: 1211 at net/netfilter/core.c:50 1 __nf_unregister_net_hook+0x21a/0x260 [...] [ 127.322519] Call Trace: [ 127.322521] [ 127.322524] ? __warn+0x9f/0x1a0 [ 127.322531] ? __nf_unregister_net_hook+0x21a/0x260 [ 127.322537] ? report_bug+0x1b1/0x1e0 [ 127.322545] ? handle_bug+0x3c/0x70 [ 127.322552] ? exc_invalid_op+0x17/0x40 [ 127.322556] ? asm_exc_invalid_op+0x1a/0x20 [ 127.322563] ? kasan_save_free_info+0x3b/0x60 [ 127.322570] ? __nf_unregister_net_hook+0x6a/0x260 [ 127.322577] ? __nf_unregister_net_hook+0x21a/0x260 [ 127.322583] ? __nf_unregister_net_hook+0x6a/0x260 [ 127.322590] ? __nf_tables_unregister_hook+0x8a/0xe0 [nf_tables] [ 127.322655] nft_table_disable+0x75/0xf0 [nf_tables] [ 127.322717] nf_tables_commit+0x2571/0x2620 [nf_tables]

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel's netfilter subsystem, adding a new basechain after toggling the dormant flag on a table leads to inconsistent hook state and a warning during unregistration, potentially causing a denial of service.

Vulnerability

Description

CVE-2024-35900 is a vulnerability in the Linux kernel's netfilter nf_tables subsystem. The issue arises when the dormant flag is toggled on a table, which disables hooks during the commit phase by iterating over current chains. However, if a new basechain is added after the flag update, it is not included in this iteration, leading to an inconsistent state. This inconsistency results in a kernel warning when attempting to unregister an already unregistered net hook, as demonstrated by the call trace in the official description.

Exploitation

Exploitation requires the ability to add nftables rules, typically requiring the CAP_NET_ADMIN capability. An attacker can trigger the bug by executing a sequence of nftables commands: adding a table, adding a chain with a hook, setting the table to dormant, and then adding a new basechain with another hook. This sequence causes the system to attempt to unregister the new chain's hook during table disable, even though it was never properly registered due to the dormant flag handling.

Impact

The primary impact is a kernel warning, which can lead to a denial of service (DoS) if the warning escalates to a system crash or instability. The vulnerability is classified as medium severity with a CVSS v3 score of 5.5, indicating a moderate risk of availability impact.

Mitigation

Patches have been released in the Linux kernel stable repository to address this issue. The fix ensures that new basechains are rejected after the table flag update, preventing the inconsistent state. Users should update their kernels to versions that include the commits referenced in the kernel stable tree.

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

95

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

10

News mentions

0

No linked articles in our index yet.