What is CVE-2024-35899?

CVE-2024-35899 is a Medium severity Linux kernel vulnerability with a CVSS score of 6.1 out of 10, classified as a Race Condition flaw (CWE-362), affecting Linux kernel versions from 4.20 onward and patched in 5.4.274, 5.10.215, 5.15.154 and others. CVE-2024-35899 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2024-35899?

CVE-2024-35899 has a CVSS score of 6.1 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H.

Is there a patch available for CVE-2024-35899?

Yes, CVE-2024-35899 has been patched. Fixed versions include 5.4.274, 5.10.215, 5.15.154 and others. If you are running Linux kernel 4.20 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2024-35899 actively exploited?

CVE-2024-35899 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is Race Condition (CWE-362)?

The product contains a code sequence that can run concurrently with other code, creating unexpected states. See MITRE CWE for full details: https://cwe.mitre.org/data/definitions/362.html

CVE-2024-35899

Medium

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: flush pending destroy work before exit_net release Similar to 2c9f0293280e ("netfilter: nf_tables: flush pending destroy work before netlink notifier") to address a race between exit_net and the destroy workqueue. The trace below shows an element to be released via destroy workqueue while exit_net path (triggered via module removal) has already released the set that is used in such transaction. [ 1360.547789] BUG: KASAN: slab-use-after-free in nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.547861] Read of size 8 at addr ffff888140500cc0 by task kworker/4:1/152465 [ 1360.547870] CPU: 4 PID: 152465 Comm: kworker/4:1 Not tainted 6.8.0+ #359 [ 1360.547882] Workqueue: events nf_tables_trans_destroy_work [nf_tables] [ 1360.547984] Call Trace: [ 1360.547991] <TASK> [ 1360.547998] dump_stack_lvl+0x53/0x70 [ 1360.548014] print_report+0xc4/0x610 [ 1360.548026] ? __virt_addr_valid+0xba/0x160 [ 1360.548040] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 1360.548054] ? nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.548176] kasan_report+0xae/0xe0 [ 1360.548189] ? nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.548312] nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.548447] ? __pfx_nf_tables_trans_destroy_work+0x10/0x10 [nf_tables] [ 1360.548577] ? _raw_spin_unlock_irq+0x18/0x30 [ 1360.548591] process_one_work+0x2f1/0x670 [ 1360.548610] worker_thread+0x4d3/0x760 [ 1360.548627] ? __pfx_worker_thread+0x10/0x10 [ 1360.548640] kthread+0x16b/0x1b0 [ 1360.548653] ? __pfx_kthread+0x10/0x10 [ 1360.548665] ret_from_fork+0x2f/0x50 [ 1360.548679] ? __pfx_kthread+0x10/0x10 [ 1360.548690] ret_from_fork_asm+0x1a/0x30 [ 1360.548707] </TASK> [ 1360.548719] Allocated by task 192061: [ 1360.548726] kasan_save_stack+0x20/0x40 [ 1360.548739] kasan_save_track+0x14/0x30 [ 1360.548750] __kasan_kmalloc+0x8f/0xa0 [ 1360.548760] __kmalloc_node+0x1f1/0x450 [ 1360.548771] nf_tables_newset+0x10c7/0x1b50 [nf_tables] [ 1360.548883] nfnetlink_rcv_batch+0xbc4/0xdc0 [nfnetlink] [ 1360.548909] nfnetlink_rcv+0x1a8/0x1e0 [nfnetlink] [ 1360.548927] netlink_unicast+0x367/0x4f0 [ 1360.548935] netlink_sendmsg+0x34b/0x610 [ 1360.548944] ____sys_sendmsg+0x4d4/0x510 [ 1360.548953] ___sys_sendmsg+0xc9/0x120 [ 1360.548961] __sys_sendmsg+0xbe/0x140 [ 1360.548971] do_syscall_64+0x55/0x120 [ 1360.548982] entry_SYSCALL_64_after_hwframe+0x55/0x5d [ 1360.548994] Freed by task 192222: [ 1360.548999] kasan_save_stack+0x20/0x40 [ 1360.549009] kasan_save_track+0x14/0x30 [ 1360.549019] kasan_save_free_info+0x3b/0x60 [ 1360.549028] poison_slab_object+0x100/0x180 [ 1360.549036] __kasan_slab_free+0x14/0x30 [ 1360.549042] kfree+0xb6/0x260 [ 1360.549049] __nft_release_table+0x473/0x6a0 [nf_tables] [ 1360.549131] nf_tables_exit_net+0x170/0x240 [nf_tables] [ 1360.549221] ops_exit_list+0x50/0xa0 [ 1360.549229] free_exit_list+0x101/0x140 [ 1360.549236] unregister_pernet_operations+0x107/0x160 [ 1360.549245] unregister_pernet_subsys+0x1c/0x30 [ 1360.549254] nf_tables_module_exit+0x43/0x80 [nf_tables] [ 1360.549345] __do_sys_delete_module+0x253/0x370 [ 1360.549352] do_syscall_64+0x55/0x120 [ 1360.549360] entry_SYSCALL_64_after_hwframe+0x55/0x5d (gdb) list *__nft_release_table+0x473 0x1e033 is in __nft_release_table (net/netfilter/nf_tables_api.c:11354). 11349 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) { 11350 list_del(&flowtable->list); 11351 nft_use_dec(&table->use); 11352 nf_tables_flowtable_destroy(flowtable); 11353 } 11354 list_for_each_entry_safe(set, ns, &table->sets, list) { 11355 list_del(&set->list); 11356 nft_use_dec(&table->use); 11357 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) 11358 nft_map_deactivat ---truncated---

Package Linux Kernel

Published 2024-05-19

Last modified 2026-05-12

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

6.1

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Weakness type

CWE-362

CVE-2024-35899 is a Race Condition vulnerability

What is Race Condition?

The product contains a code sequence that can run concurrently with other code, creating unexpected states. Learn more on MITRE CWE

Affected versions

Linux kernel versions 4.20 and later are affected. Fixed in 5.4.274, 5.10.215, 5.15.154, 6.1.85, 6.6.26, 6.8.5, 6.9 and their respective stable series.

Affected from

≥ 4.20

Fixed in

✓ 5.4.274 5.4.x ✓ 5.10.215 5.10.x ✓ 5.15.154 5.15.x ✓ 6.1.85 6.1.x ✓ 6.6.26 6.6.x ✓ 6.8.5 6.8.x ✓ 6.9

References

9 total

Kernel Git
https://git.kernel.org/stable/c/24cea9677025e0de419989ecb692acd4bb34cac2

Patch
Kernel Git
https://git.kernel.org/stable/c/333b5085522cf1898d5a0d92616046b414f631a7

Patch
Kernel Git
https://git.kernel.org/stable/c/46c4481938e2ca62343b16ea83ab28f4c1733d31

Patch
Kernel Git
https://git.kernel.org/stable/c/4e8447a9a3d367b5065a0b7abe101da6e0037b6e

Patch
Kernel Git
https://git.kernel.org/stable/c/d2c9eb19fc3b11caebafde4c30a76a49203d18a6

Patch

Showing 5 of 9 references View all on NVD

Details

CVE ID CVE-2024-35899

Severity Medium

CVSS score 6.1 / 10

CVSS version 3.1

Published 2024-05-19

Modified 2026-05-12

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2024-35899?

CVE-2024-35899 is a Medium severity Linux kernel vulnerability with a CVSS score of 6.1 out of 10 , classified as a Race Condition flaw (CWE-362) . It affects Linux kernel versions from 4.20 onward and has been patched in 5.4.274, 5.10.215, 5.15.154 and others. CVE-2024-35899 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2024-35899?

CVE-2024-35899 has a CVSS score of 6.1 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H.
Is there a patch available for CVE-2024-35899?

Yes. CVE-2024-35899 has been patched. Fixed versions include 5.4.274, 5.10.215, 5.15.154 and others. If you are running Linux kernel 4.20 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2024-35899 actively exploited?

No. CVE-2024-35899 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.