CVE-2024-26609
kernel: netfilter: nf_tables: reject QUEUE/DROP verdict parameters
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · February 29, 2024
Updated · August 7, 2026
Description
[REJECTED CVE] An issue was identified in the Linux kernel's netfilter subsystem related to nf_tables. The issue occurs when a positive value, such as NF_ACCEPT, is provided in the upper 16 bits of NF_DROP verdict parameters, which are expected to contain valid errno values (e.g., -EPERM). This improper input handling could lead to memory corruption, potentially allowing attackers to exploit the system.
Statement
This CVE has been rejected upstream:- https://lore.kernel.org/linux-cve-announce/[email protected]/
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-416 · Use After Free