CVE-2024-27020 in Linux
Summary
by MITRE • 05/01/2024
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
nft_unregister_expr() can concurrent with __nft_expr_type_get(), and there is not any protection when iterate over nf_tables_expressions list in __nft_expr_type_get(). Therefore, there is potential data-race of nf_tables_expressions list entry.
Use list_for_each_entry_rcu() to iterate over nf_tables_expressions list in __nft_expr_type_get(), and use rcu_read_lock() in the caller nft_expr_type_get() to protect the entire type query process.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 02/07/2026
The vulnerability identified as CVE-2024-27020 resides within the Linux kernel's netfilter subsystem, specifically in the nf_tables implementation where a potential data-race condition exists in the __nft_expr_type_get() function. This issue manifests when nft_unregister_expr() operates concurrently with __nft_expr_type_get(), creating a scenario where multiple threads can simultaneously access and modify the nf_tables_expressions list without proper synchronization mechanisms. The flaw represents a classic race condition that can lead to memory corruption and system instability when the kernel attempts to iterate over the shared list structure during expression type queries.
The technical root cause stems from the absence of appropriate locking mechanisms during list traversal in the __nft_expr_type_get() function. When the kernel processes network filter expressions, it must iterate through the nf_tables_expressions list to determine expression types, but this iteration occurs without proper RCU (Read-Copy-Update) protection. The lack of synchronization allows for scenarios where a thread might be reading from the list while another thread modifies it through nft_unregister_expr(), potentially causing memory access violations or undefined behavior. This vulnerability directly maps to CWE-362, which describes a race condition in concurrent programming where two or more threads access shared data concurrently and at least one of the accesses is a write operation.
The operational impact of this vulnerability extends beyond simple system instability to potentially enable privilege escalation and denial of service conditions within kernel space. An attacker who can control the timing of concurrent operations might exploit this race condition to corrupt kernel memory structures, leading to system crashes or potentially allowing malicious code execution with kernel privileges. The vulnerability affects systems running Linux kernels with netfilter nf_tables functionality, particularly those implementing dynamic expression registration and unregistration. The risk is amplified in high-concurrency environments where the likelihood of simultaneous access patterns increases significantly.
Mitigation strategies for CVE-2024-27020 involve implementing proper RCU synchronization mechanisms throughout the affected code path. The fix requires replacing standard list iteration with list_for_each_entry_rcu() and ensuring that callers of nft_expr_type_get() properly acquire rcu_read_lock() before initiating the type query process. This approach aligns with ATT&CK technique T1068, which involves exploiting local privilege escalation through kernel vulnerabilities, and follows the principle of least privilege by ensuring proper synchronization. System administrators should prioritize applying kernel updates that contain the patched implementation, while security teams should monitor for potential exploitation attempts targeting this specific race condition. The solution demonstrates proper defensive programming practices by using kernel's built-in RCU mechanisms to handle concurrent access patterns safely, thereby preventing the data-race condition that could compromise system integrity.