CVE-2024-27020

HighCVSS 7.8

Published: 01/05/2024(UTC)Updated: 04/08/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Summary

A vulnerability has been identified in the Linux kernel's netfilter module that may lead to a data race when iterating over the nf_tables_expressions list. This issue has been resolved by implementing appropriate synchronization mechanisms.

Risk Assessment

The potential data race could lead to unpredictable system behavior, jeopardizing the stability and security of applications using nf_tables.

Recommendation

It is recommended to update the Linux kernel to the latest version to benefit from the fixes related to this vulnerability.

Other vulnerabilities in Linux kernel, netfilter module

CVE-2026-43190Medium
A vulnerability has been identified in the Linux kernel's netfilter module related to the TCP option parser. The issue arises from the lack of validation of the remaining option length before reading, which could lead to unexpected behavior.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() nft_unregister_expr() can concurrent with __nft_expr_type_get(), and there is not any protection when iterate over nf_tables_expressions list in __nft_expr_type_get(). Therefore, there is potential data-race of nf_tables_expressions list entry. Use list_for_each_entry_rcu() to iterate over nf_tables_expressions list in __nft_expr_type_get(), and use rcu_read_lock() in the caller nft_expr_type_get() to protect the entire type query process.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS