# CVE-2024-26924: netfilter: nft_set_pipapo: do not free live element

> A use-after-free vulnerability in the Linux kernel netfilter subsystem allows attackers to cause a system crash via crafted network filter rules.

- **Severity:** High 7.8 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 24 Apr 2024
- **Updated:** 5 Aug 2026
- **Also known as:** BELL-CVE-2024-26924, DEBIAN-CVE-2024-26924, GHSA-6vh7-f36j-r556, UBUNTU-CVE-2024-26924, USN-6863-1

## What is CVE-2024-26924?

CVE-2024-26924 is a high-severity use after free vulnerability in Debian Debian Linux, published on 24 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_set_pipapo: do not free live element

Pablo reports a crash with large batches of elements with a
back-to-back add/remove pattern.  Quoting Pablo:

  add_elem("00000000") timeout 100 ms
  ...
  add_elem("0000000X") timeout 100 ms
  del_elem("0000000X") <---------------- delete one that was just added
  ...
  add_elem("00005000") timeout 100 ms

  1) nft_pipapo_remove() removes element 0000000X
  Then, KASAN shows a splat.

Looking at the remove function there is a chance that we will drop a
rule that maps to a non-deactivated element.

Removal happens in two steps, first we do a lookup for key k and return the
to-be-removed element and mark it as inactive in the next generation.
Then, in a second step, the element gets removed from the set/map.

The _remove function does not work correctly if we have more than one
element that share the same key.

This can happen if we insert an element into a set when the set already
holds an element with same key, but the element mapping to the existing
key has timed out or is not active in the next generation.

In such case its possible that removal will unmap the wrong element.
If this happens, we will leak the non-deactivated element, it becomes
unreachable.

The element that got deactivated (and will be freed later) will
remain reachable in the set data structure, this can result in
a crash when such an element is retrieved during lookup (stale
pointer).

Add a check that the fully matching key does in fact map to the element
that we have marked as inactive in the deactivation step.
If not, we need to continue searching.

Add a bug/warn trap at the end of the function as well, the remove
function must not ever be called with an invisible/unreachable/non-existent
element.

v2: avoid uneeded temporary variable (Stefano)

Weakness: CWE-476 (NULL Pointer Dereference)

## Which versions are affected by CVE-2024-26924?

It affects 2 products.


Products: Debian Debian Linux, Linux kernel.

## How do I fix CVE-2024-26924?

Apply the vendor's patch.

## Is CVE-2024-26924 being exploited?

There is no known exploitation of CVE-2024-26924 in the wild and no public exploit code.

## Other vulnerabilities in Debian Debian Linux

- [CVE-2015-3306](https://insights.sbomify.com/CVE-2015-3306/): ProFTPD Improper Access Control (critical 10.0, exploited in the wild)
- [CVE-2025-49113](https://insights.sbomify.com/CVE-2025-49113/): RoundCube Webmail Deserialization of Untrusted Data (critical 9.9, exploited in the wild)
- [CVE-2026-24061](https://insights.sbomify.com/CVE-2026-24061/): GNU InetUtils Argument Injection (critical 9.8, exploited in the wild)
- [CVE-2025-39682](https://insights.sbomify.com/CVE-2025-39682/): Linux Kernel Improper Check for Unusual or Exceptional Conditions (critical 9.8, exploited in the wild)
- [CVE-2024-9680](https://insights.sbomify.com/CVE-2024-9680/): Mozilla Firefox Use-After-Free (critical 9.8, exploited in the wild)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2024-26924 and fix it if it is affected.

What it is: CVE-2024-26924 is a high-severity use after free vulnerability in Debian Debian Linux, published on 24 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2024-26924 in the wild and no public exploit code.

Affected product: Debian Debian Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2024-26924/ (Markdown: https://insights.sbomify.com/CVE-2024-26924/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2024-26924
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-26924
- OSV: https://osv.dev/vulnerability/CVE-2024-26924

---
From sbomify Insights: https://insights.sbomify.com/CVE-2024-26924/
Summaries are generated and may contain mistakes; the official description above is the record.