# CVE-2024-26581: netfilter: nft_set_rbtree: skip end interval element from gc

> CVE-2024-26581 (GitHub advisory GHSA-92f7-c7hw-58cr) is a high-severity vulnerability with a CVSS 3.1 base score of 7.8, classed as Use After Free (CWE-416), in Kernel (Linux). Affected versions: < 5.4.269; >= 5.5.0, < 5.10.210; >= 5.11.0, < 5.15.149; >= 5.16.0, < 6.1.78; >= 6.2.0, < 6.6.17; >= 6.5.0, < 6.7.5. It is fixed in 5.4.269, 5.10.210, 5.15.149, 6.1.78, 6.6.17 or 6.7.5, depending on the release line.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2024-26581

| Field | Value |
| --- | --- |
| CVE | CVE-2024-26581 |
| GHSA | GHSA-92f7-c7hw-58cr |
| Severity | High |
| CVSS 3.1 | 7.8 `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` (GitHub Advisory Database) |
| CWE | CWE-416 Use After Free |
| EPSS | 2.22% (higher than 81% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation none, automatable no, technical impact total |
| Published | 20 Feb 2024 |
| Modified | 5 Aug 2026 |

## Description

netfilter: nft_set_rbtree: skip end interval element from gc

rbtree lazy gc on insert might collect an end interval element that has
been just added in this transactions, skip end interval elements that
are not yet active.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| Kernel | Linux | none | < 5.4.269; >= 5.5.0, < 5.10.210; >= 5.11.0, < 5.15.149; >= 5.16.0, < 6.1.78; >= 6.2.0, < 6.6.17; >= 6.5.0, < 6.7.5 | 5.4.269, 5.10.210, 5.15.149, 6.1.78, 6.6.17, 6.7.5 |

## Fix commits

- Patch: https://git.kernel.org/stable/c/10e9cb39313627f2eae4cd70c4b742074e998fd8
- Patch: https://git.kernel.org/stable/c/1296c110c5a0b45a8fcf58e7d18bc5da61a565cb
- Patch: https://git.kernel.org/stable/c/2bab493a5624444ec6e648ad0d55a362bcb4c003
- Patch: https://git.kernel.org/stable/c/4cee42fcf54fec46b344681e7cc4f234bb22f85a
- Patch: https://git.kernel.org/stable/c/60c0c230c6f046da536d3df8b39a20b9a9fd6af0
- Patch: https://git.kernel.org/stable/c/6eb14441f10602fa1cf691da9d685718b68b78a9
- Patch: https://git.kernel.org/stable/c/b734f7a47aeb32a5ba298e4ccc16bb0c52b6dbf7
- Patch: https://git.kernel.org/stable/c/c60d252949caf9aba537525195edae6bbabc35eb

## Questions

**What is the GHSA ID for CVE-2024-26581?**

GitHub tracks CVE-2024-26581 as GHSA-92f7-c7hw-58cr.

**What is the CVSS score of CVE-2024-26581?**

CVE-2024-26581 has a CVSS 3.1 base score of 7.8 (High), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

**Which versions are affected by CVE-2024-26581?**

Kernel (Linux): < 5.4.269; >= 5.5.0, < 5.10.210; >= 5.11.0, < 5.15.149; >= 5.16.0, < 6.1.78; >= 6.2.0, < 6.6.17; >= 6.5.0, < 6.7.5.

**How do I fix CVE-2024-26581?**

Upgrade to 5.4.269, 5.10.210, 5.15.149, 6.1.78, 6.6.17 or 6.7.5, depending on the release line. The fix is in commits 10e9cb3, 1296c11 and 2bab493.

**Is CVE-2024-26581 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2024-26581. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 2.22% chance of exploitation in the next 30 days, higher than 81% of CVEs.

## References

- https://git.kernel.org/stable/c/10e9cb39313627f2eae4cd70c4b742074e998fd8 (fix)
- https://git.kernel.org/stable/c/1296c110c5a0b45a8fcf58e7d18bc5da61a565cb (fix)
- https://git.kernel.org/stable/c/2bab493a5624444ec6e648ad0d55a362bcb4c003 (fix)
- https://git.kernel.org/stable/c/4cee42fcf54fec46b344681e7cc4f234bb22f85a (fix)
- https://git.kernel.org/stable/c/60c0c230c6f046da536d3df8b39a20b9a9fd6af0 (fix)
- https://git.kernel.org/stable/c/6eb14441f10602fa1cf691da9d685718b68b78a9 (fix)
- https://git.kernel.org/stable/c/b734f7a47aeb32a5ba298e4ccc16bb0c52b6dbf7 (fix)
- https://git.kernel.org/stable/c/c60d252949caf9aba537525195edae6bbabc35eb (fix)
- https://git.kernel.org/stable/c/1296c110c5a0 (fix)
- https://git.kernel.org/stable/c/60c0c230c6f0 (fix)
- https://git.kernel.org/stable/c/6eb14441f106 (fix)
- https://git.kernel.org/stable/c/b734f7a47aeb (fix)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26581.json (advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2024-26581 (advisory)
- https://github.com/advisories/GHSA-92f7-c7hw-58cr (advisory)
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git (package)
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2024-26581), compiled from GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.