Skip to content
OpenAdvisories
High · 7.8 CVE-2024-1085 EUVD-2024-16860GHSA-3xpr-x643-29v6

Use-after-free in Linux kernel's netfilter: nf_tables component

Published Jan 31, 2024 · Updated May 29, 2025 · Assigned by Google

Vendor: Linux Product: kernel Package: kernel Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.15 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-fips Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.15 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-azure-fips Package: linux-bluefield Package: linux-fips Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.15 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-fips Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.15 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-5.15 Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-intel-iotg Package: linux-intel-iotg-5.15 Package: linux-kvm Package: linux-lowlatency Package: linux-lowlatency-hwe-5.15 Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-nvidia Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-tegra Package: linux-nvidia-tegra-5.15 Package: linux-nvidia-tegra-igx Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.5 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.15 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-raspi Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.15 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.5 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Package: linux-xilinx-zynqmp Platform: Linux Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

The nft_setelem_catchall_deactivate() function checks whether the catch-all set element is active in the current generation instead of the next generation before freeing it, but only flags it inactive in the next generation, making it possible to free the element multiple times, leading to a double free vulnerability.

We recommend upgrading past commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7.

Affected products

VendorProductAffectedFixed
Linux Kernel 5.13 – < 6.8 6.8

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.6.15-1 —
Debian 13 linux 6.6.15-1 —
Debian 12 linux 6.1.76-1 —
ReleasePackageFixed inAdvisory
Ubuntu Nvidia-BlueField 22.04 LTS linux-bluefield 5.15.0-1038.40 —
Ubuntu 22.04 LTS linux +1 5.15.0-101.111 USN-6704-1
Ubuntu 22.04 LTS linux-aws 5.15.0-1056.61 USN-6705-1
Ubuntu 22.04 LTS linux-aws-6.5 +1 6.5.0-1016.16~22.04.1 USN-6707-3, USN-6707-1
Ubuntu 22.04 LTS linux-azure 5.15.0-1059.67 USN-6704-1
Ubuntu 22.04 LTS linux-azure-6.5 6.5.0-1017.17~22.04.1 USN-6707-4
Ubuntu 22.04 LTS linux-azure-fde 5.15.0-1059.67.1 USN-6704-1
Ubuntu 22.04 LTS linux-gcp 5.15.0-1054.62 USN-6704-1
Ubuntu 22.04 LTS linux-gke +1 5.15.0-1053.58 USN-6704-1
Ubuntu 22.04 LTS linux-gkeop 5.15.0-1039.45 USN-6704-1
Ubuntu 22.04 LTS linux-hwe-6.5 6.5.0-26.26~22.04.1 USN-6707-1
Ubuntu 22.04 LTS linux-ibm +1 5.15.0-1049.52 USN-6704-2, USN-6704-1
Ubuntu 22.04 LTS linux-intel-iotg 5.15.0-1051.57 USN-6704-4
Ubuntu 22.04 LTS linux-nvidia 5.15.0-1047.47 USN-6704-1
Ubuntu 22.04 LTS linux-nvidia-6.5 6.5.0-1014.14 —
Ubuntu 22.04 LTS linux-nvidia-tegra 5.15.0-1025.25 —
Ubuntu 22.04 LTS linux-nvidia-tegra-igx 5.15.0-1012.12 —
Ubuntu 22.04 LTS linux-oem-6.1 6.1.0-1035.35 USN-6688-1
Ubuntu 22.04 LTS linux-oem-6.5 6.5.0-1018.19 USN-6707-1
Ubuntu 22.04 LTS linux-oracle 5.15.0-1054.60 USN-6704-3
Ubuntu 22.04 LTS linux-oracle-6.5 6.5.0-1019.19~22.04.1 USN-6707-1
Ubuntu 22.04 LTS linux-riscv +20 No fix yet —
Ubuntu 22.04 LTS linux-riscv-6.5 +1 6.5.0-26.26.1~22.04.1 USN-6707-1
Ubuntu 22.04 LTS linux-starfive-6.5 6.5.0-1010.11~22.04.1 USN-6707-1
Ubuntu 22.04 LTS linux-xilinx-zynqmp 5.15.0-1030.34 —
Ubuntu 20.04 LTS linux-aws-5.15 5.15.0-1056.61~20.04.1 USN-6705-1
Ubuntu 20.04 LTS linux-azure-5.15 5.15.0-1059.67~20.04.1 USN-6704-1
Ubuntu 20.04 LTS linux-azure-fde-5.15 5.15.0-1059.67~20.04.1.1 USN-6704-1
Ubuntu 20.04 LTS linux-gcp-5.15 5.15.0-1054.62~20.04.1 USN-6704-1
Ubuntu 20.04 LTS linux-gke +26 No fix yet —
Ubuntu 20.04 LTS linux-gkeop-5.15 5.15.0-1039.45~20.04.1 USN-6704-1
Ubuntu 20.04 LTS linux-hwe-5.15 +1 5.15.0-101.111~20.04.1 USN-6704-1
Ubuntu 20.04 LTS linux-ibm-5.15 5.15.0-1049.52~20.04.1 USN-6704-1
Ubuntu 20.04 LTS linux-intel-iotg-5.15 5.15.0-1051.57~20.04.1 USN-6704-4
Ubuntu 20.04 LTS linux-nvidia-tegra-5.15 5.15.0-1025.25~20.04.1 —
Ubuntu 20.04 LTS linux-oracle-5.15 5.15.0-1054.60~20.04.1 USN-6704-3
Ubuntu 20.04 LTS linux-riscv-5.15 5.15.0-1052.56~20.04.1 —
Ubuntu 18.04 LTS linux-gcp +13 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro Realtime 24.04 LTS linux-raspi-realtime 6.8.0-2001.1 —
Ubuntu Pro Realtime 22.04 LTS linux-intel-iot-realtime 5.15.0-1049.51 —
Ubuntu Pro Realtime 22.04 LTS linux-realtime 5.15.0-1057.64 —
Ubuntu Pro FIPS-updates 22.04 LTS linux-aws-fips 5.15.0-1056.61+fips1 —
Ubuntu Pro FIPS-updates 22.04 LTS linux-azure-fips 5.15.0-1059.67+fips1 —
Ubuntu Pro FIPS-updates 22.04 LTS linux-fips 5.15.0-101.111+fips1 —
Ubuntu Pro FIPS-updates 22.04 LTS linux-gcp-fips 5.15.0-1055.63+fips2 —
Ubuntu Pro FIPS-preview 22.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro 22.04 LTS linux 5.15.0-102.112 LSN-0103-1
Ubuntu Pro 22.04 LTS linux-aws 5.15.0-1057.63 LSN-0103-1
Ubuntu Pro 22.04 LTS linux-aws-6.5 +1 6.5.0-1016.16~22.04.1 LSN-0103-1
Ubuntu Pro 22.04 LTS linux-azure 5.15.0-1060.69 LSN-0103-1
Ubuntu Pro 22.04 LTS linux-azure-6.5 6.5.0-1017.17~22.04.1 LSN-0103-1
Ubuntu Pro 22.04 LTS linux-gcp 5.15.0-1055.63 LSN-0103-1
Ubuntu Pro 22.04 LTS linux-gke 5.15.0-1054.59 LSN-0103-1
Ubuntu Pro 22.04 LTS linux-hwe-6.5 6.5.0-26.26~22.04.1 LSN-0103-1
Ubuntu Pro 22.04 LTS linux-ibm 5.15.0-1050.53 LSN-0103-1
Ubuntu Pro 20.04 LTS linux 5.4.0-176.196 LSN-0103-1
Ubuntu Pro 20.04 LTS linux-aws 5.4.0-1122.132 LSN-0103-1
Ubuntu Pro 20.04 LTS linux-aws-5.15 5.15.0-1057.63~20.04.1 LSN-0103-1
Ubuntu Pro 20.04 LTS linux-azure 5.4.0-1127.134 LSN-0103-1
Ubuntu Pro 20.04 LTS linux-gcp 5.4.0-1126.135 LSN-0103-1
Ubuntu Pro 20.04 LTS linux-gcp-5.15 5.15.0-1055.63~20.04.1 LSN-0103-1
Ubuntu Pro 20.04 LTS linux-gke No fix yet LSN-0103-1
Ubuntu Pro 20.04 LTS linux-hwe-5.15 +1 5.15.0-102.112~20.04.1 LSN-0103-1
Ubuntu Pro 20.04 LTS linux-ibm-5.15 5.15.0-1050.53~20.04.1 LSN-0103-1
Ubuntu Pro 18.04 LTS linux-aws-5.4 5.4.0-1122.132~18.04.1 LSN-0103-1
Ubuntu Pro 18.04 LTS linux-azure-5.4 5.4.0-1127.134~18.04.1 LSN-0103-1
Ubuntu Pro 18.04 LTS linux-gcp-5.4 5.4.0-1126.135~18.04.1 LSN-0103-1
Ubuntu Pro 18.04 LTS linux-hwe-5.4 5.4.0-175.195~18.04.1 LSN-0103-1
ReleasePackageFixed inAdvisory
RHEL 9 bpftool 7.3.0-427.13.1.el9_4 RHSA-2024:2394
RHEL 9 rv +64 5.14.0-427.13.1.el9_4 RHSA-2024:2394
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.2 EUS bpftool 7.0.0-284.55.1.el9_2 RHSA-2024:1018
RHEL 9.2 EUS kernel-rt +14 5.14.0-284.55.1.rt14.340.el9_2 RHSA-2024:1019
RHEL 9.2 EUS perf +48 5.14.0-284.55.1.el9_2 RHSA-2024:1018

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 bpftool 7.3.0-427.13.1.el9_4 ALSA-2024:2394
AlmaLinux 9 rv +60 5.14.0-427.13.1.el9_4 ALSA-2024:2394
ReleasePackageFixed inAdvisory
SLES 15 SP5 kernel-64kb +6 5.14.21-150500.55.49.1 SUSE-SU-2024:0516-1
SLES 15 SP5 kernel-azure +2 5.14.21-150500.33.34.1 SUSE-SU-2024:0514-1
SLES 15 SP5 kernel-default-base 5.14.21-150500.55.49.1.150500.6.21.2 SUSE-SU-2024:0516-1
SLES 15 SP4 kernel-64kb +6 5.14.21-150400.24.108.1 SUSE-SU-2024:0515-1
SLES 15 SP4 kernel-default-base 5.14.21-150400.24.108.1.150400.24.50.2 SUSE-SU-2024:0515-1
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP4 kernel-default-base 5.14.21-150400.24.108.1.150400.24.50.2 SUSE-SU-2024:0515-1
SLES for SAP 15 SP4 kernel-docs +4 5.14.21-150400.24.108.1 SUSE-SU-2024:0515-1
SLE Micro 5.5 kernel-default 5.14.21-150500.55.49.1 SUSE-SU-2024:0516-1
SLE Micro 5.5 kernel-default-base 5.14.21-150500.55.49.1.150500.6.21.2 SUSE-SU-2024:0516-1
SLE Micro 5.5 kernel-rt 5.14.21-150500.13.35.1 SUSE-SU-2024:0469-1
SLE Micro 5.4 kernel-default 5.14.21-150400.24.108.1 SUSE-SU-2024:0515-1
SLE Micro 5.4 kernel-default-base 5.14.21-150400.24.108.1.150400.24.50.2 SUSE-SU-2024:0515-1
SLE Micro 5.4 kernel-rt 5.14.21-150400.15.68.1 SUSE-SU-2024:0476-1
SLE Micro 5.3 kernel-default 5.14.21-150400.24.108.1 SUSE-SU-2024:0515-1
SLE Micro 5.3 kernel-default-base 5.14.21-150400.24.108.1.150400.24.50.2 SUSE-SU-2024:0515-1
SLE Micro 5.3 kernel-rt 5.14.21-150400.15.68.1 SUSE-SU-2024:0476-1
SLE Live Patching 15 SP5 kernel-default 5.14.21-150500.55.49.1 SUSE-SU-2024:0516-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5-RT_Update_0 10-150500.9.1 SUSE-SU-2024:1181-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5-RT_Update_3 8-150500.2.1 SUSE-SU-2024:1183-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_0 10-150500.9.2 SUSE-SU-2024:1236-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_1 9-150500.2.1 SUSE-SU-2024:1252-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_10 +1 1-150500.11.5.1 SUSE-SU-2024:0516-1, SUSE-SU-2024:0469-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_5 7-150500.2.1 SUSE-SU-2024:1251-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_6 6-150500.2.1 SUSE-SU-2024:1274-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_8 +1 5-150500.2.1 SUSE-SU-2024:1239-1, SUSE-SU-2024:1184-1
SLE Live Patching 15 SP4 kernel-default 5.14.21-150400.24.108.1 SUSE-SU-2024:0515-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4-RT_Update_18 1-150400.1.3.1 SUSE-SU-2024:0476-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_10 13-150400.2.1 SUSE-SU-2024:1299-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_12 12-150400.2.1 SUSE-SU-2024:1312-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_16 8-150400.2.1 SUSE-SU-2024:1288-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_19 6-150400.2.1 SUSE-SU-2024:1292-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_20 5-150400.2.1 SUSE-SU-2024:1318-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_22 3-150400.2.1 SUSE-SU-2024:1298-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_23 1-150400.9.5.1 SUSE-SU-2024:0515-1
SLE HPC 15 SP4 kernel-64kb +5 5.14.21-150400.24.108.1 SUSE-SU-2024:0515-1
SLE HPC 15 SP4 kernel-default-base 5.14.21-150400.24.108.1.150400.24.50.2 SUSE-SU-2024:0515-1
SUSE Real Time Module 15 SP5 kernel-rt +3 5.14.21-150500.13.35.1 SUSE-SU-2024:0469-1
SUSE Manager Server 4.3 kernel-default-base 5.14.21-150400.24.108.1.150400.24.50.2 SUSE-SU-2024:0515-1
SUSE Manager Server 4.3 kernel-source +2 5.14.21-150400.24.108.1 SUSE-SU-2024:0515-1
SUSE Manager Proxy 4.3 kernel-default-base 5.14.21-150400.24.108.1.150400.24.50.2 SUSE-SU-2024:0515-1
SUSE Manager Proxy 4.3 kernel-source +1 5.14.21-150400.24.108.1 SUSE-SU-2024:0515-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.5 dtb-aarch64 +10 5.14.21-150500.55.49.1 SUSE-SU-2024:0516-1
openSUSE Leap 15.5 kernel-azure +2 5.14.21-150500.33.34.1 SUSE-SU-2024:0514-1
openSUSE Leap 15.5 kernel-default-base 5.14.21-150500.55.49.1.150500.6.21.2 SUSE-SU-2024:0516-1
openSUSE Leap 15.5 kernel-rt +3 5.14.21-150500.13.35.1 SUSE-SU-2024:0469-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
openSUSE Leap Micro 5.4 kernel-default 5.14.21-150400.24.108.1 SUSE-SU-2024:0515-1
openSUSE Leap Micro 5.4 kernel-default-base 5.14.21-150400.24.108.1.150400.24.50.2 SUSE-SU-2024:0515-1
openSUSE Leap Micro 5.4 kernel-rt 5.14.21-150400.15.68.1 SUSE-SU-2024:0476-1
openSUSE Leap Micro 5.3 kernel-default 5.14.21-150400.24.108.1 SUSE-SU-2024:0515-1
openSUSE Leap Micro 5.3 kernel-default-base 5.14.21-150400.24.108.1.150400.24.50.2 SUSE-SU-2024:0515-1
openSUSE Leap Micro 5.3 kernel-rt 5.14.21-150400.15.68.1 SUSE-SU-2024:0476-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 kernel-livepatch-6.1.75-99.163 1.0-0.amzn2023 ALAS2023-2024-519
Amazon Linux 2023 perf +14 6.1.75-99.163.amzn2023 ALAS2023-2024-519

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 kernel 6.6.35.1-5 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 bpftool 7.3.0-427.13.1.el9_4 ELSA-2024-2394
Oracle Linux 9 rv +27 5.14.0-427.13.1.el9_4 ELSA-2024-2394
Oracle Linux 8 bpftool +13 5.15.0-204.147.6.2.el9uek ELSA-2024-12208

Advisories 38

References