Answer in brief
CVE-2024-42109 records a Unknown severity vulnerability in netfilter: nf_tables: unconditionally flush pending work before notifier. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2024-42109 records a Unknown severity vulnerability in netfilter: nf_tables: unconditionally flush pending work before notifier. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=f22954f8c58fd5f5489f5980796914e306757e77 <3325628cb36b7f216c5716e7b5124d9dc81199e4 || >=41841b585e53babdfb0fa6fdfa54f6d7c28c1206 <4c06c13317b9a08decedcd7aaf706691e336277c || >=2c9f0293280e258606e54ed2b96fa71498432eae <55a40406aac555defe9bdd0adec9508116ce7cb1 || >=2c9f0293280e258606e54ed2b96fa71498432eae <09e650c3a3a7d804430260510534ccbf71c75b2e || >=2c9f0293280e258606e54ed2b96fa71498432eae <9f6958ba2e902f9820c594869bd710ba74b7c4c0 || 4167aa477abcf62b0dfda51f3513280fa73cd588 || >=5.15.129 <5.15.163 || >=6.1.50 <6.1.98 || >=6.4.13 <6.5 | 3325628cb36b7f216c5716e7b5124d9dc81199e4, 4c06c13317b9a08decedcd7aaf706691e336277c, 55a40406aac555defe9bdd0adec9508116ce7cb1, 09e650c3a3a7d804430260510534ccbf71c75b2e, 9f6958ba2e902f9820c594869bd710ba74b7c4c0, 5.15.163, 6.1.98, 6.5 |
| Linux/Linuxgeneric | 6.5 | Not reported |
Published upstream
Jul 30, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: unconditionally flush pending work before notifier syzbot reports: KASAN: slab-uaf in nft_ctx_update include/net/netfilter/nf_tables.h:1831 KASAN: slab-uaf in nft_commit_release net/netfilter/nf_tables_api.c:9530 KASAN: slab-uaf int nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597 Read of size 2 at addr ffff88802b0051c4 by task kworker/1:1/45 [..] Workqueue: events nf_tables_trans_destroy_work Call Trace: nft_ctx_update include/net/netfilter/nf_tables.h:1831 [inline] nft_commit_release net/netfilter/nf_tables_api.c:9530 [inline] nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597 Problem is that the notifier does a conditional flush, but its possible that the table-to-be-removed is still referenced by transactions being processed by the worker, so we need to flush unconditionally. We could make the flush_work depend on whether we found a table to delete in nf-next to avoid the flush for most cases. AFAICS this problem is only exposed in nf-next, with commit e169285f8c56 ("netfilter: nf_tables: do not store nft_ctx in transaction objects"), with this commit applied there is an unconditional fetch of table->family which is whats triggering the above splat.
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=f22954f8c58fd5f5489f5980796914e306757e77 <3325628cb36b7f216c5716e7b5124d9dc81199e4 || >=41841b585e53babdfb0fa6fdfa54f6d7c28c1206 <4c06c13317b9a08decedcd7aaf706691e336277c || >=2c9f0293280e258606e54ed2b96fa71498432eae <55a40406aac555defe9bdd0adec9508116ce7cb1 || >=2c9f0293280e258606e54ed2b96fa71498432eae <09e650c3a3a7d804430260510534ccbf71c75b2e || >=2c9f0293280e258606e54ed2b96fa71498432eae <9f6958ba2e902f9820c594869bd710ba74b7c4c0 || 4167aa477abcf62b0dfda51f3513280fa73cd588 || >=5.15.129 <5.15.163 || >=6.1.50 <6.1.98 || >=6.4.13 <6.5 | 3325628cb36b7f216c5716e7b5124d9dc81199e4, 4c06c13317b9a08decedcd7aaf706691e336277c, 55a40406aac555defe9bdd0adec9508116ce7cb1, 09e650c3a3a7d804430260510534ccbf71c75b2e, 9f6958ba2e902f9820c594869bd710ba74b7c4c0, 5.15.163, 6.1.98, 6.5 |
| Linux/Linuxgeneric | 6.5 | Not reported |
Published upstream
Jul 30, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: unconditionally flush pending work before notifier syzbot reports: KASAN: slab-uaf in nft_ctx_update include/net/netfilter/nf_tables.h:1831 KASAN: slab-uaf in nft_commit_release net/netfilter/nf_tables_api.c:9530 KASAN: slab-uaf int nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597 Read of size 2 at addr ffff88802b0051c4 by task kworker/1:1/45 [..] Workqueue: events nf_tables_trans_destroy_work Call Trace: nft_ctx_update include/net/netfilter/nf_tables.h:1831 [inline] nft_commit_release net/netfilter/nf_tables_api.c:9530 [inline] nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597 Problem is that the notifier does a conditional flush, but its possible that the table-to-be-removed is still referenced by transactions being processed by the worker, so we need to flush unconditionally. We could make the flush_work depend on whether we found a table to delete in nf-next to avoid the flush for most cases. AFAICS this problem is only exposed in nf-next, with commit e169285f8c56 ("netfilter: nf_tables: do not store nft_ctx in transaction objects"), with this commit applied there is an unconditional fetch of table->family which is whats triggering the above splat.
Quoted source text, attributed separately from HOL analysis.