Skip to content
OpenAdvisories
High 1 exploited CVE LSN-0103-1 7 CVEs

Kernel Live Patch Security Notice

Published Apr 30, 2024 · Updated Jun 3, 2026

Ecosystem: Ubuntu

Summary

Lonial Con discovered that the netfilter subsystem in the Linux kernel
contained a memory leak when handling certain element flush operations. A
local attacker could use this to expose sensitive information (kernel
memory).(CVE-2023-4569)

Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did
not properly handle inactive elements in its PIPAPO data structure, leading
to a use-after-free vulnerability. A local attacker could use this to cause
a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-6817)

It was discovered that a race condition existed in the AppleTalk networking
subsystem of the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code.(CVE-2023-51781)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did
not properly check deactivated elements in certain situations, leading to a
use-after-free vulnerability. A local attacker could use this to cause a
denial of service (system crash) or possibly execute arbitrary code.(CVE-2024-0193)

Lonial Con discovered that the netfilter subsystem in the Linux kernel did
not properly handle element deactivation in certain cases, leading to a
use-after-free vulnerability. A local attacker could use this to cause a
denial of service (system crash) or possibly execute arbitrary code.(CVE-2024-1085)

Notselwyn discovered that the netfilter subsystem in the Linux kernel did
not properly handle verdict parameters in certain cases, leading to a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.(CVE-2024-1086)

In the Linux kernel, the following vulnerability has been
resolved: net: qualcomm: rmnet: fix global oob in rmnet_policy The variable
rmnet_link_ops assign a *bigger* maxtype which leads to a global out-of-
bounds read when parsing the netlink attributes. (CVE-2024-26597)

Fixed packages 24

ReleasePackageFixed in
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS linux-aws-5.4 5.4.0-1122.132~18.04.1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS linux-azure-5.4 5.4.0-1127.134~18.04.1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS linux-gcp-5.4 5.4.0-1126.135~18.04.1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS linux-hwe-5.4 5.4.0-175.195~18.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux 5.4.0-176.196
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-aws 5.4.0-1122.132
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-aws-5.15 5.15.0-1057.63~20.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-azure 5.4.0-1127.134
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-gcp 5.4.0-1126.135
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-gcp-5.15 5.15.0-1055.63~20.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-gke —
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-hwe-5.15 5.15.0-102.112~20.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-ibm-5.15 5.15.0-1050.53~20.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-lowlatency-hwe-5.15 5.15.0-102.112~20.04.1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux 5.15.0-102.112
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-aws 5.15.0-1057.63
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-aws-6.5 6.5.0-1016.16~22.04.1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-azure 5.15.0-1060.69
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-azure-6.5 6.5.0-1017.17~22.04.1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-gcp 5.15.0-1055.63
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-gcp-6.5 6.5.0-1016.16~22.04.1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-gke 5.15.0-1054.59
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-hwe-6.5 6.5.0-26.26~22.04.1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-ibm 5.15.0-1050.53

Vulnerabilities 7

  • High 7.8
    CVE-2024-1086 Exploited · Ransomware Public exploit EPSS 28%

    Use-after-free in Linux kernel's netfilter: nf_tables component

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slo…

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
    KEV May 30, 2024
  • High 7.8
    CVE-2023-6817

    Use-after-free in Linux kernel's netfilter: nf_tables component

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PI…

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-0193

    Kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation

    A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on an NFT_CHAIN object or …

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  • High 7.8
    CVE-2024-1085

    Use-after-free in Linux kernel's netfilter: nf_tables component

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_setelem_catchall_deactivate() function checks whether the catch-all set element is active in the current genera…

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-26597

    net: qualcomm: rmnet: fix global oob in rmnet_policy

    In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix global oob in rmnet_policy The variable rmnet_link_ops assign a *bigger* maxtype which leads to a global out-of-bounds read when parsing the netlink attributes. See …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2023-4569

    Kernel: information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c

    A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux Kernel. This issue may allow a local attacker to cause double-deactivations of catchall elements, which can result in a memory leak.

    Red Hat Fedora Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2023-51781

    An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-after-free becau…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2023-4569
  • report
    https://ubuntu.com/security/CVE-2023-6817
  • report
    https://ubuntu.com/security/CVE-2023-51781
  • report
    https://ubuntu.com/security/CVE-2024-0193
  • report
    https://ubuntu.com/security/CVE-2024-1085
  • report
    https://ubuntu.com/security/CVE-2024-1086
  • report
    https://ubuntu.com/security/CVE-2024-26597