High 7.8Published May 1, 2024

CVE-2024-27020netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()

Updated under an hour ago (Oct 27, 2026, 11:30 PM ET)

Does this affect you?

It affects Linux and 8 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() nft_unregister_expr() can concurrent with __nft_expr_type_get(), and there is not any protection when iterate over nf_tables_expressions list in __nft_expr_type_get(). Therefore, there is potential data-race of nf_tables_expressions list entry. Use list_for_each_entry_rcu() to iterate over nf_tables_expressions list in __nft_expr_type_get(), and use rcu_read_lock() in the caller nft_expr_type_get() to protect the entire type query process.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-362
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ef1f7df9170dbd875ce198ba84e6ab80f6fc139e before 939109c0a8e2a006a6cc8209e262d25065f4403a; from ef1f7df9170dbd875ce198ba84e6ab80f6fc139e before b38a133d37fa421c8447b383d788c9cc6f5cb34c; from ef1f7df9170dbd875ce198ba84e6ab80f6fc139e before 934e66e231cff2b18faa2c8aad0b8cec13957e05; from ef1f7df9170dbd875ce198ba84e6ab80f6fc139e before 0b6de00206adbbfc6373b3ae38d2a6f197987907; from ef1f7df9170dbd875ce198ba84e6ab80f6fc139e before 8d56bad42ac4c43c6c72ddd6a654a2628bf839c5; from ef1f7df9170dbd875ce198ba84e6ab80f6fc139e before a9ebf340d123ae12582210407f879d6a5a1bc25b; from ef1f7df9170dbd875ce198ba84e6ab80f6fc139e before 01f1a678b05ade4b1248019c2dcca773aebbeb7f; from ef1f7df9170dbd875ce198ba84e6ab80f6fc139e before f969eb84ce482331a991079ab7a5c4dc3b7f89bf	CNA record
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name)	before V3.1	CISA ADP
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family siemens:scalance_xc_300_xr_300_xc_400_xr_500wg_xr_500_family (from the name)	all versions not affected	CISA ADP
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family siemens:scalance_xcm_xrm_xch_xrh_300_family (from the name)	before V3.1	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	before V1.1.1	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
linux linux_kernel linux:linux_kernel	from 3.13 before 4.19.313; from 4.20 before 5.4.275; from 5.5 before 5.10.216; from 5.11 before 5.15.157; from 5.16 before 6.1.88; from 6.2 before 6.6.29; from 6.7 before 6.8.8; 6.9; and 3 more ranges	NVD

References

References

https://git.kernel.org/stable/c/939109c0a8e2a006a6cc8209e262d25065f4403a	patch
https://git.kernel.org/stable/c/b38a133d37fa421c8447b383d788c9cc6f5cb34c	patch
https://git.kernel.org/stable/c/934e66e231cff2b18faa2c8aad0b8cec13957e05	patch
https://git.kernel.org/stable/c/0b6de00206adbbfc6373b3ae38d2a6f197987907	patch
https://git.kernel.org/stable/c/8d56bad42ac4c43c6c72ddd6a654a2628bf839c5	patch
https://git.kernel.org/stable/c/a9ebf340d123ae12582210407f879d6a5a1bc25b	patch
https://git.kernel.org/stable/c/01f1a678b05ade4b1248019c2dcca773aebbeb7f	patch
https://git.kernel.org/stable/c/f969eb84ce482331a991079ab7a5c4dc3b7f89bf	patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
1–10 of 16

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.