CVE-2024-27403

A flaw was found in the Linux kernel's Netfilter subsystem. When configuring flow offloading, ownership of a destination route object is transferred without properly clearing its reference in the original route structure. If the flow offload setup subsequently fails, the error-handling path releases the route object a second time, triggering a reference count underflow. A local user can exploit this vulnerability to cause memory corruption, resulting in a system crash and Denial of Service (DoS).

Red Hat has classified this vulnerability as having a Low impact because exploiting it requires an uncommon network configuration involving nftables flowtables and depends on a rare failure condition during flow offload addition. Default Red Hat Enterprise Linux deployments do not configure nftables flow offloading, significantly limiting exposure in standard environments. Additionally, an attacker must have local access with network administration privileges to manipulate flowtable rules, and any resulting exploitation is restricted to triggering an operational denial of service via a kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.