CVE-2024-35899

A vulnerability was found in the Linux kernel's Netfilter framework, specifically within the nf_tables component. The issue arises from a race condition between the exit_net function and the destroy work queue, which can lead to use-after-free errors and potential system instability. This vulnerability has been addressed by making sure that any pending destroy work is flushed before releasing network namespaces, thereby preventing the race condition. Users are advised to update their Linux kernel to a version that includes this fix to maintain system stability and security.

This vulnerability is classified with a Moderate severity rating for Red Hat Enterprise Linux because exploitation is limited to local users with specific privileges to manipulate network namespaces or packet filtering rules, constraining the attack vector. While default installations enable the Netfilter subsystem to support local firewalling and container networking, triggering this race condition requires concurrent operations during network namespace teardown or module unloading. A successful exploit results in memory corruption that can trigger a kernel crash, leading to a denial of service without directly granting unauthorized remote access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.