Read the docs
TI-2024-23863 Aliases CVE-2024-36005GHSA-74r2-q9hq-437j

netfilter: nf_tables: honor table dormant flag from netdev release event path

Priority LOW 24Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 24 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: honor table dormant flag from netdev release event path Check for table dormant flag otherwise netdev release event path tries to unregister an already unregistered hook. [524854.857999] ------------[ cut here ]------------ [524854.858010] WARNING: CPU: 0 PID: 3386599 at net/netfilter/core.c:501 __nf_unregister_net_hook+0x21a/0x260 [...] [524854.858848] CPU: 0 PID: 3386599 Comm: kworker/u32:2 Not tainted 6.9.0-rc3+ #365 [524854.858869] Workqueue: netns cleanup_net [524854.858886] RIP: 0010:__nf_unregister_net_hook+0x21a/0x260 [524854.858903] Code: 24 e8 aa 73 83 ff 48 63 43 1c 83 f8 01 0f 85 3d ff ff ff e8 98 d1 f0 ff 48 8b 3c 24 e8 8f 73 83 ff 48 63 43 1c e9 26 ff ff ff <0f> 0b 48 83 c4 18 48 c7 c7 00 68 e9 82 5b 5d 41 5c 41 5d 41 5e 41 [524854.858914] RSP: 0018:ffff8881e36d79e0 EFLAGS: 00010246 [524854.858926] RAX: 0000000000000000 RBX: ffff8881339ae790 RCX: ffffffff81ba524a [524854.858936] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff8881c8a16438 [524854.858945] RBP: ffff8881c8a16438 R08: 0000000000000001 R09: ffffed103c6daf34 [524854.858954] R10: ffff8881e36d79a7 R11: 0000000000000000 R12: 0000000000000005 [524854.858962] R13: ffff8881c8a16000 R14: 0000000000000000 R15: ffff8881351b5a00 [524854.858971] FS: 0000000000000000(0000) GS:ffff888390800000(0000) knlGS:0000000000000000 [524854.858982] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [524854.858991] CR2: 00007fc9be0f16f4 CR3: 00000001437cc004 CR4: 00000000001706f0 [524854.859000] Call Trace: [524854.859006] <TASK> [524854.859013] ? __warn+0x9f/0x1a0 [524854.859027] ? __nf_unregister_net_hook+0x21a/0x260 [524854.859044] ? report_bug+0x1b1/0x1e0 [524854.859060] ? handle_bug+0x3c/0x70 [524854.859071] ? exc_invalid_op+0x17/0x40 [524854.859083] ? asm_exc_invalid_op+0x1a/0x20 [524854.859100] ? __nf_unregister_net_hook+0x6a/0x260 [524854.859116] ? __nf_unregister_net_hook+0x21a/0x260 [524854.859135] nf_tables_netdev_event+0x337/0x390 [nf_tables] [524854.859304] ? __pfx_nf_tables_netdev_event+0x10/0x10 [nf_tables] [524854.859461] ? packet_notifier+0xb3/0x360 [524854.859476] ? _raw_spin_unlock_irqrestore+0x11/0x40 [524854.859489] ? dcbnl_netdevice_event+0x35/0x140 [524854.859507] ? __pfx_nf_tables_netdev_event+0x10/0x10 [nf_tables] [524854.859661] notifier_call_chain+0x7d/0x140 [524854.859677] unregister_netdevice_many_notify+0x5e1/0xae0

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00233 14th percentileScored 2026-11-07
Fix Partial Linux (Linux): 5.10.216, 5.15.158, 6.1.90 +3Red Hat: 9 advisoriesRed Hat: 24 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux5.5 and later5.10.216, 5.15.158, 6.1.90, 6.6.30, 6.8.9, 6.9Patch availableCNA
  • Linux VendorLinux Affected 5.5 and later Fixed in 5.10.216, 5.15.158, 6.1.90, 6.6.30, 6.8.9, 6.9 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*5.5 to before 5.10.216; 5.11 to before 5.15.158; 5.16 to before 6.1.90; 6.2 to before 6.6.30; 6.7 to before 6.8.9VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*6.9 rc1VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*6.9 rc2VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*6.9 rc3VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*6.9 rc4VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*6.9 rc5VulnerableLinux
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 5.5 to before 5.10.216; 5.11 to before 5.15.158; 5.16 to before 6.1.90; 6.2 to before 6.6.30; 6.7 to before 6.8.9 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:* Versions 6.9 rc1 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:* Versions 6.9 rc2 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:* Versions 6.9 rc3 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:* Versions 6.9 rc4 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:* Versions 6.9 rc5 Vulnerable ·Linux
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · CNA Linux (Linux) Fixed in 5.10.216, 5.15.158, 6.1.90, 6.6.30, 6.8.9, 6.9

Red Hat 9 advisories

  • RHSA-2024:6993 Released 2024-09-24 · Red Hat rating Important
    kernel security update
    • Red Hat CodeReady Linux Builder EUS (v.8.8) kernel-tools-libs-devel-4.18.0-477.74.1.el8_8
    • Red Hat Enterprise Linux BaseOS EUS (v.8.8) bpftool-4.18.0-477.74.1.el8_8, kernel-4.18.0-477.74.1.el8_8, kernel-abi-stablelists-4.18.0-477.74.1.el8_8 +19
  • RHSA-2024:5363 Released 2024-08-15 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-427.31.1.el9_4, kernel-64k-debug-devel-matched-5.14.0-427.31.1.el9_4, kernel-64k-devel-5.14.0-427.31.1.el9_4 +11
    • Red Hat Enterprise Linux BaseOS (v. 9) bpftool-7.3.0-427.31.1.el9_4, kernel-5.14.0-427.31.1.el9_4, kernel-64k-5.14.0-427.31.1.el9_4 +29
    • Red Hat Enterprise Linux CRB (v. 9) kernel-tools-libs-devel-5.14.0-427.31.1.el9_4, libperf-5.14.0-427.31.1.el9_4
    • Red Hat Enterprise Linux NFV (v. 9) kernel-rt-5.14.0-427.31.1.el9_4, kernel-rt-core-5.14.0-427.31.1.el9_4, kernel-rt-debug-5.14.0-427.31.1.el9_4 +11
    • Red Hat Enterprise Linux RT (v. 9) kernel-rt-5.14.0-427.31.1.el9_4, kernel-rt-core-5.14.0-427.31.1.el9_4, kernel-rt-debug-5.14.0-427.31.1.el9_4 +9
  • RHSA-2024:5282 Released 2024-08-13 · Red Hat rating Important
    kernel-rt security update
    • Red Hat Enterprise Linux NFV TUS (v.8.4) kernel-rt-4.18.0-305.138.1.rt7.214.el8_4, kernel-rt-core-4.18.0-305.138.1.rt7.214.el8_4, kernel-rt-debug-4.18.0-305.138.1.rt7.214.el8_4 +9
    • Red Hat Enterprise Linux RT TUS (v.8.4) kernel-rt-4.18.0-305.138.1.rt7.214.el8_4, kernel-rt-core-4.18.0-305.138.1.rt7.214.el8_4, kernel-rt-debug-4.18.0-305.138.1.rt7.214.el8_4 +7
Show 6 more Red Hat advisories
  • RHSA-2024:5266 Released 2024-08-13 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) bpftool-4.18.0-305.138.1.el8_4, kernel-4.18.0-305.138.1.el8_4, kernel-abi-stablelists-4.18.0-305.138.1.el8_4 +14
    • Red Hat Enterprise Linux BaseOS E4S (v.8.4) bpftool-4.18.0-305.138.1.el8_4, kernel-4.18.0-305.138.1.el8_4, kernel-abi-stablelists-4.18.0-305.138.1.el8_4 +14
    • Red Hat Enterprise Linux BaseOS TUS (v.8.4) bpftool-4.18.0-305.138.1.el8_4, kernel-4.18.0-305.138.1.el8_4, kernel-abi-stablelists-4.18.0-305.138.1.el8_4 +14
  • RHSA-2024:5101 Released 2024-08-08 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-553.16.1.el8_10, kernel-4.18.0-553.16.1.el8_10, kernel-abi-stablelists-4.18.0-553.16.1.el8_10 +19
    • Red Hat Enterprise Linux CRB (v. 8) kernel-tools-libs-devel-4.18.0-553.16.1.el8_10
  • RHSA-2024:5102 Released 2024-08-08 · Red Hat rating Important
    kernel-rt security update
    • Red Hat Enterprise Linux NFV (v. 8) kernel-rt-4.18.0-553.16.1.rt7.357.el8_10, kernel-rt-core-4.18.0-553.16.1.rt7.357.el8_10, kernel-rt-debug-4.18.0-553.16.1.rt7.357.el8_10 +9
    • Red Hat Enterprise Linux RT (v. 8) kernel-rt-4.18.0-553.16.1.rt7.357.el8_10, kernel-rt-core-4.18.0-553.16.1.rt7.357.el8_10, kernel-rt-debug-4.18.0-553.16.1.rt7.357.el8_10 +7
  • RHSA-2024:4554 Released 2024-07-15 · Red Hat rating Important
    kernel-rt security update
    • Red Hat Enterprise Linux Real Time EUS (v.9.2) kernel-rt-5.14.0-284.73.1.rt14.358.el9_2, kernel-rt-core-5.14.0-284.73.1.rt14.358.el9_2, kernel-rt-debug-5.14.0-284.73.1.rt14.358.el9_2 +9
    • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.2) kernel-rt-5.14.0-284.73.1.rt14.358.el9_2, kernel-rt-core-5.14.0-284.73.1.rt14.358.el9_2, kernel-rt-debug-5.14.0-284.73.1.rt14.358.el9_2 +11
  • RHSA-2024:4533 Released 2024-07-15 · Red Hat rating Important
    kernel security update
    • Red Hat CodeReady Linux Builder EUS (v.9.2) kernel-tools-libs-devel-5.14.0-284.73.1.el9_2
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) kernel-64k-debug-devel-5.14.0-284.73.1.el9_2, kernel-64k-debug-devel-matched-5.14.0-284.73.1.el9_2, kernel-64k-devel-5.14.0-284.73.1.el9_2 +9
    • Red Hat Enterprise Linux BaseOS EUS (v.9.2) bpftool-7.0.0-284.73.1.el9_2, kernel-5.14.0-284.73.1.el9_2, kernel-64k-5.14.0-284.73.1.el9_2 +29
  • RHSA-2024:4447 Released 2024-07-10 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) bpftool-4.18.0-372.111.1.el8_6, kernel-4.18.0-372.111.1.el8_6, kernel-abi-stablelists-4.18.0-372.111.1.el8_6 +14
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) bpftool-4.18.0-372.111.1.el8_6, kernel-4.18.0-372.111.1.el8_6, kernel-abi-stablelists-4.18.0-372.111.1.el8_6 +19
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) bpftool-4.18.0-372.111.1.el8_6, kernel-4.18.0-372.111.1.el8_6, kernel-abi-stablelists-4.18.0-372.111.1.el8_6 +14

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat CodeReady Linux Builder EUS (v.8.8)Fixed RHSA-2024:6993
Red Hat CodeReady Linux Builder EUS (v.9.2)Fixed RHSA-2024:4533
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:5363
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:4533
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2024:5101
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2024:5363
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2024:5266
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2024:4447
Red Hat Enterprise Linux BaseOS E4S (v.8.4)Fixed RHSA-2024:5266
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2024:4447
Red Hat Enterprise Linux BaseOS EUS (v.8.8)Fixed RHSA-2024:6993
Red Hat Enterprise Linux BaseOS EUS (v.9.2)Fixed RHSA-2024:4533
Red Hat Enterprise Linux BaseOS TUS (v.8.4)Fixed RHSA-2024:5266
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2024:4447
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2024:5101
Red Hat Enterprise Linux CRB (v. 9)Fixed RHSA-2024:5363
Red Hat Enterprise Linux NFV (v. 8)Fixed RHSA-2024:5102
Red Hat Enterprise Linux NFV (v. 9)Fixed RHSA-2024:5363
Red Hat Enterprise Linux NFV TUS (v.8.4)Fixed RHSA-2024:5282
Red Hat Enterprise Linux RT (v. 8)Fixed RHSA-2024:5102
Red Hat Enterprise Linux RT (v. 9)Fixed RHSA-2024:5363
Red Hat Enterprise Linux RT TUS (v.8.4)Fixed RHSA-2024:5282
Red Hat Enterprise Linux Real Time EUS (v.9.2)Fixed RHSA-2024:4554
Red Hat Enterprise Linux Real Time for NFV EUS (v.9.2)Fixed RHSA-2024:4554
Not affected: 4 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux AppStream EUS (v.9.2)
  • Red Hat Enterprise Linux CRB (v. 9)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-36005
  2. 2026-10-03 Alias added: GHSA-74r2-q9hq-437j

References

Patch 6

Advisory 1

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
  • TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
See all 15278 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences