CVE-2024-56655 (GCVE-0-2024-56655)

Vulnerability from cvelistv5 – Published: 2024-12-27 15:06 – Updated: 2026-08-05 11:45
VLAI
Title
netfilter: nf_tables: do not defer rule destruction via call_rcu
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not defer rule destruction via call_rcu nf_tables_chain_destroy can sleep, it can't be used from call_rcu callbacks. Moreover, nf_tables_rule_release() is only safe for error unwinding, while transaction mutex is held and the to-be-desroyed rule was not exposed to either dataplane or dumps, as it deactives+frees without the required synchronize_rcu() in-between. nft_rule_expr_deactivate() callbacks will change ->use counters of other chains/sets, see e.g. nft_lookup .deactivate callback, these must be serialized via transaction mutex. Also add a few lockdep asserts to make this more explicit. Calling synchronize_rcu() isn't ideal, but fixing this without is hard and way more intrusive. As-is, we can get: WARNING: .. net/netfilter/nf_tables_api.c:5515 nft_set_destroy+0x.. Workqueue: events nf_tables_trans_destroy_work RIP: 0010:nft_set_destroy+0x3fe/0x5c0 Call Trace: <TASK> nf_tables_trans_destroy_work+0x6b7/0xad0 process_one_work+0x64a/0xce0 worker_thread+0x613/0x10d0 In case the synchronize_rcu becomes an issue, we can explore alternatives. One way would be to allocate nft_trans_rule objects + one nft_trans_chain object, deactivate the rules + the chain and then defer the freeing to the nft destroy workqueue. We'd still need to keep the synchronize_rcu path as a fallback to handle -ENOMEM corner cases though.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9eee6097ffb26cdd2adb988c0d378fa0d650c737 , < 5146c27b2780aac59876a887a5f4e793b8949862 (git)
Affected: 558f503f707f481bbf40efa74a938b8021df841d , < 2991dc357a28b61c13ed1f7b59e9251e2b4562fb (git)
Affected: a394c160d57f4b083bd904a22802f6fb7f5b3cea , < b8d8f53e1858178882b881b8c09f94ef0e83bf76 (git)
Affected: e6c32a64d61184c2bdf89442b3d31ef530afba34 , < b0f013bebf94fe7ae75e5a53be2f2bd1cc1841e3 (git)
Affected: bfd05c68e4c6320304e9f371ffa356b6e4b9cc53 , < 27f0574253f6c24c8ee4e3f0a685b75ed3a256ed (git)
Affected: c03d278fdf35e73dd0ec543b9b556876b9d9a8dc , < 7cf0bd232b565d9852cb25fd094f77254773e048 (git)
Affected: c03d278fdf35e73dd0ec543b9b556876b9d9a8dc , < b04df3da1b5c6f6dc7cdccc37941740c078c4043 (git)
Affected: cb401e5799e0acacb405f2128097e9c4ccf82f8a (git)
Affected: 6.6.61 , < 6.6.67 (semver)
Affected: 6.11.8 , < 6.12 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.6.67 , ≤ 6.6.* (semver)
Unaffected: 6.12.6 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_tables.h",
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5146c27b2780aac59876a887a5f4e793b8949862",
              "status": "affected",
              "version": "9eee6097ffb26cdd2adb988c0d378fa0d650c737",
              "versionType": "git"
            },
            {
              "lessThan": "2991dc357a28b61c13ed1f7b59e9251e2b4562fb",
              "status": "affected",
              "version": "558f503f707f481bbf40efa74a938b8021df841d",
              "versionType": "git"
            },
            {
              "lessThan": "b8d8f53e1858178882b881b8c09f94ef0e83bf76",
              "status": "affected",
              "version": "a394c160d57f4b083bd904a22802f6fb7f5b3cea",
              "versionType": "git"
            },
            {
              "lessThan": "b0f013bebf94fe7ae75e5a53be2f2bd1cc1841e3",
              "status": "affected",
              "version": "e6c32a64d61184c2bdf89442b3d31ef530afba34",
              "versionType": "git"
            },
            {
              "lessThan": "27f0574253f6c24c8ee4e3f0a685b75ed3a256ed",
              "status": "affected",
              "version": "bfd05c68e4c6320304e9f371ffa356b6e4b9cc53",
              "versionType": "git"
            },
            {
              "lessThan": "7cf0bd232b565d9852cb25fd094f77254773e048",
              "status": "affected",
              "version": "c03d278fdf35e73dd0ec543b9b556876b9d9a8dc",
              "versionType": "git"
            },
            {
              "lessThan": "b04df3da1b5c6f6dc7cdccc37941740c078c4043",
              "status": "affected",
              "version": "c03d278fdf35e73dd0ec543b9b556876b9d9a8dc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cb401e5799e0acacb405f2128097e9c4ccf82f8a",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.67",
              "status": "affected",
              "version": "6.6.61",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_tables.h",
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.67",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.67",
                  "versionStartIncluding": "6.6.61",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.6",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: do not defer rule destruction via call_rcu\n\nnf_tables_chain_destroy can sleep, it can\u0027t be used from call_rcu\ncallbacks.\n\nMoreover, nf_tables_rule_release() is only safe for error unwinding,\nwhile transaction mutex is held and the to-be-desroyed rule was not\nexposed to either dataplane or dumps, as it deactives+frees without\nthe required synchronize_rcu() in-between.\n\nnft_rule_expr_deactivate() callbacks will change -\u003euse counters\nof other chains/sets, see e.g. nft_lookup .deactivate callback, these\nmust be serialized via transaction mutex.\n\nAlso add a few lockdep asserts to make this more explicit.\n\nCalling synchronize_rcu() isn\u0027t ideal, but fixing this without is hard\nand way more intrusive.  As-is, we can get:\n\nWARNING: .. net/netfilter/nf_tables_api.c:5515 nft_set_destroy+0x..\nWorkqueue: events nf_tables_trans_destroy_work\nRIP: 0010:nft_set_destroy+0x3fe/0x5c0\nCall Trace:\n \u003cTASK\u003e\n nf_tables_trans_destroy_work+0x6b7/0xad0\n process_one_work+0x64a/0xce0\n worker_thread+0x613/0x10d0\n\nIn case the synchronize_rcu becomes an issue, we can explore alternatives.\n\nOne way would be to allocate nft_trans_rule objects + one nft_trans_chain\nobject, deactivate the rules + the chain and then defer the freeing to the\nnft destroy workqueue.  We\u0027d still need to keep the synchronize_rcu path as\na fallback to handle -ENOMEM corner cases though."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is driven entirely from local interfaces \u2014 nfnetlink/NETLINK_NETFILTER to build a netdev-family basechain with rules, and RTNETLINK to unregister the device that fires the NETDEV_UNREGISTER notifier. No remote peer can drive basechain release.\nAC:L - The attacker owns both sides: it creates the netns, the device, and the ruleset, chooses when to delete the device, and issues concurrent nftables transactions that race the unserialized softirq callback, repeating indefinitely; the sleeping-in-atomic path (`cancel_delayed_work_sync`/`mutex_lock` from an RCU softirq callback) is deterministic and needs no race at all.\nPR:L - nfnetlink only requires `netlink_net_capable(skb, CAP_NET_ADMIN)`, evaluated against the network namespace\u0027s user_ns, so an unprivileged local user obtains everything needed via `unshare -Urn` \u2014 including creating and deleting the dummy/veth device that triggers the notifier.\nUI:N - The attacker performs every step itself \u2014 ruleset setup, device removal, and the concurrent transactions; no victim action or pre-existing administrator configuration is needed.\nS:U - Corruption is confined to nf_tables kernel objects within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - Unserialized `nft_use_dec()` on `set-\u003euse`/`chain-\u003euse`/`obj-\u003euse` races the commit-mutex-protected control plane, so counters underflow and still-referenced sets/chains are freed, yielding a use-after-free whose reclaimed contents the attacker can shape and read back via ruleset dumps.\nI:H - The softirq callback performs `list_del_rcu()` on `table-\u003esets`/`table-\u003echains` and `rhltable_remove()` on `chains_ht` concurrently with control-plane insertions/removals, giving list and rhashtable corruption on top of the UAF \u2014 both standard springboards to controlled kernel writes and control-flow hijack.\nA:H - Sleeping functions (`cancel_delayed_work_sync`, `mutex_lock` via `nf_ct_netns_put`, `nf_tables_chain_destroy`) invoked from an RCU softirq callback produce \"sleeping function called from invalid context\" BUGs and scheduler corruption, and the refcount/list corruption reliably ends in WARNs, oopses, and panics."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:45:53.066Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5146c27b2780aac59876a887a5f4e793b8949862"
        },
        {
          "url": "https://git.kernel.org/stable/c/2991dc357a28b61c13ed1f7b59e9251e2b4562fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8d8f53e1858178882b881b8c09f94ef0e83bf76"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0f013bebf94fe7ae75e5a53be2f2bd1cc1841e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/27f0574253f6c24c8ee4e3f0a685b75ed3a256ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/7cf0bd232b565d9852cb25fd094f77254773e048"
        },
        {
          "url": "https://git.kernel.org/stable/c/b04df3da1b5c6f6dc7cdccc37941740c078c4043"
        }
      ],
      "title": "netfilter: nf_tables: do not defer rule destruction via call_rcu",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56655",
    "datePublished": "2024-12-27T15:06:19.033Z",
    "dateReserved": "2024-12-27T15:00:39.841Z",
    "dateUpdated": "2026-08-05T11:45:53.066Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56655",
      "date": "2026-09-21",
      "epss": "0.00225",
      "percentile": "0.13359"
    },
    "microsoft_vex": {
      "current_release_date": "2025-03-13T00:00:00.000Z",
      "cve": "CVE-2024-56655",
      "id": "msrc_CVE-2024-56655",
      "initial_release_date": "2024-12-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "netfilter: nf_tables: do not defer rule destruction via call_rcu",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-56655.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/net/netfilter/nf_tables.h",
                  "net/netfilter/nf_tables_api.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5146c27b2780aac59876a887a5f4e793b8949862",
                    "status": "affected",
                    "version": "9eee6097ffb26cdd2adb988c0d378fa0d650c737",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2991dc357a28b61c13ed1f7b59e9251e2b4562fb",
                    "status": "affected",
                    "version": "558f503f707f481bbf40efa74a938b8021df841d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b8d8f53e1858178882b881b8c09f94ef0e83bf76",
                    "status": "affected",
                    "version": "a394c160d57f4b083bd904a22802f6fb7f5b3cea",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b0f013bebf94fe7ae75e5a53be2f2bd1cc1841e3",
                    "status": "affected",
                    "version": "e6c32a64d61184c2bdf89442b3d31ef530afba34",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "27f0574253f6c24c8ee4e3f0a685b75ed3a256ed",
                    "status": "affected",
                    "version": "bfd05c68e4c6320304e9f371ffa356b6e4b9cc53",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7cf0bd232b565d9852cb25fd094f77254773e048",
                    "status": "affected",
                    "version": "c03d278fdf35e73dd0ec543b9b556876b9d9a8dc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b04df3da1b5c6f6dc7cdccc37941740c078c4043",
                    "status": "affected",
                    "version": "c03d278fdf35e73dd0ec543b9b556876b9d9a8dc",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "cb401e5799e0acacb405f2128097e9c4ccf82f8a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.6.67",
                    "status": "affected",
                    "version": "6.6.61",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12",
                    "status": "affected",
                    "version": "6.11.8",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/net/netfilter/nf_tables.h",
                  "net/netfilter/nf_tables_api.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.12"
                  },
                  {
                    "lessThan": "6.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.67",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.13",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C62FB1DE-4AB5-4D7C-98C4-53F3C7625780",
                    "versionEndExcluding": "6.6.67",
                    "versionStartIncluding": "6.6.61",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "08380928-8FCA-4224-BB24-9918A2D1E85E",
                    "versionEndExcluding": "6.12.6",
                    "versionStartIncluding": "6.11.8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "62567B3C-6CEE-46D0-BC2E-B3717FBF7D13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "5A073481-106D-4B15-B4C7-FB0213B8E1D4",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: do not defer rule destruction via call_rcu\n\nnf_tables_chain_destroy can sleep, it can\u0027t be used from call_rcu\ncallbacks.\n\nMoreover, nf_tables_rule_release() is only safe for error unwinding,\nwhile transaction mutex is held and the to-be-desroyed rule was not\nexposed to either dataplane or dumps, as it deactives+frees without\nthe required synchronize_rcu() in-between.\n\nnft_rule_expr_deactivate() callbacks will change -\u003euse counters\nof other chains/sets, see e.g. nft_lookup .deactivate callback, these\nmust be serialized via transaction mutex.\n\nAlso add a few lockdep asserts to make this more explicit.\n\nCalling synchronize_rcu() isn\u0027t ideal, but fixing this without is hard\nand way more intrusive.  As-is, we can get:\n\nWARNING: .. net/netfilter/nf_tables_api.c:5515 nft_set_destroy+0x..\nWorkqueue: events nf_tables_trans_destroy_work\nRIP: 0010:nft_set_destroy+0x3fe/0x5c0\nCall Trace:\n \u003cTASK\u003e\n nf_tables_trans_destroy_work+0x6b7/0xad0\n process_one_work+0x64a/0xce0\n worker_thread+0x613/0x10d0\n\nIn case the synchronize_rcu becomes an issue, we can explore alternatives.\n\nOne way would be to allocate nft_trans_rule objects + one nft_trans_chain\nobject, deactivate the rules + the chain and then defer the freeing to the\nnft destroy workqueue.  We\u0027d still need to keep the synchronize_rcu path as\na fallback to handle -ENOMEM corner cases though."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nf_tables: no aplazar la destrucci\u00f3n de la regla mediante call_rcu nf_tables_chain_destroy puede dormir, no se puede utilizar desde las devoluciones de llamadas call_rcu. Adem\u00e1s, nf_tables_rule_release() solo es seguro para desenrollar errores, mientras se mantiene el mutex de transacci\u00f3n y la regla a destruir no se expuso ni al plano de datos ni a los volcados, ya que desactiva + libera sin elsynchronous_rcu() requerido en el medio. Las devoluciones de llamadas nft_rule_expr_deactivate() cambiar\u00e1n -\u0026gt;use contadores de otras cadenas/conjuntos, consulte, por ejemplo, la devoluci\u00f3n de llamada nft_lookup .deactivate, que se deben serializar mediante el mutex de transacci\u00f3n. Agregue tambi\u00e9n algunas afirmaciones lockdep para que esto sea m\u00e1s expl\u00edcito. Llamar asynchronous_rcu() no es ideal, pero solucionar esto sin \u00e9l es dif\u00edcil y mucho m\u00e1s intrusivo. Tal como est\u00e1, podemos obtener: ADVERTENCIA: .. net/netfilter/nf_tables_api.c:5515 nft_set_destroy+0x.. Cola de trabajo: eventos nf_tables_trans_destroy_work RIP: 0010:nft_set_destroy+0x3fe/0x5c0 Rastreo de llamadas:  nf_tables_trans_destroy_work+0x6b7/0xad0 process_one_work+0x64a/0xce0 worker_thread+0x613/0x10d0 En caso de que elsynchronous_rcu se convierta en un problema, podemos explorar alternativas. Una forma ser\u00eda asignar objetos nft_trans_rule + un objeto nft_trans_chain, desactivar las reglas + la cadena y luego diferir la liberaci\u00f3n a la cola de trabajo de destrucci\u00f3n de nft. A\u00fan as\u00ed, necesitar\u00edamos mantener la ruta synchronization_rcu como respaldo para gestionar casos especiales de -ENOMEM."
          }
        ],
        "id": "CVE-2024-56655",
        "lastModified": "2026-08-04T11:22:18.720",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2024-12-27T15:15:25.343",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/27f0574253f6c24c8ee4e3f0a685b75ed3a256ed"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2991dc357a28b61c13ed1f7b59e9251e2b4562fb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5146c27b2780aac59876a887a5f4e793b8949862"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7cf0bd232b565d9852cb25fd094f77254773e048"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b04df3da1b5c6f6dc7cdccc37941740c078c4043"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b0f013bebf94fe7ae75e5a53be2f2bd1cc1841e3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b8d8f53e1858178882b881b8c09f94ef0e83bf76"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T03:52:56+00:00",
      "cve": "CVE-2024-56655",
      "id": "CVE-2024-56655",
      "initial_release_date": "2024-12-27T00:00:00+00:00",
      "product_status:known_affected": "28",
      "product_status:known_not_affected": "170",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: nf_tables: do not defer rule destruction via call_rcu",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56655.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.