Security readout for executives and security teams
Plain-English summary
CVE-2024-27012 is a Linux kernel nf_tables bug where a failed set deletion can leave internal set elements in the wrong state. The public record shows a kernel warning and object mapping memory leak. No CVSS score, CWE, or KEV active-exploitation listing is provided in the source bundle.
Executive priority
Schedule remediation through the normal kernel patch process, with higher priority for shared, exposed, or security-sensitive Linux systems. Current evidence is incomplete for business-impact scoring because the public bundle lacks CVSS, CWE, exploitation claims, and clear attacker impact.
Technical view
The nf_tables abort path used set->ops->walk() in a way that skipped the wrong generation of elements. nft_mapelem_activate() could fail to restore original refcounts after delete-set failure. The fix changes iterator callback logic, reverses activation filtering, toggles the next-generation bit on delete, and clears it during abort restoration.
Likely exposure
Exposure is Linux systems running affected kernel builds with nf_tables present. The bundle names Linux kernel 6.4, 6.1.176, 6.8.8, and 6.9 as affected, while other listed stable versions and commits are marked unaffected. Distro kernel package mapping must be verified separately.
Exploitation context
The source bundle does not claim active exploitation and marks KEV false. It also does not provide exploitability details, prerequisites, or attacker impact. Treat this as a kernel maintenance vulnerability requiring vendor tracking, not as confirmed in-the-wild activity.
Researcher notes
The record is precise about the faulty abort-path state restoration but sparse on security impact. Avoid assuming privilege escalation or denial of service without additional vendor evidence. Useful follow-up is correlating the referenced stable commits with distribution kernel changelogs and local kernel configuration.
Mitigation direction
- Check the running kernel against vendor advisories for CVE-2024-27012.
- Apply the relevant stable kernel or distribution kernel update.
- Prioritize hosts using nftables or netfilter-heavy workloads.
- Track Fedora and Linux stable announcements for package-specific fixes.
- If patch timing is blocked, follow vendor guidance for interim controls.
Validation and detection
- Inventory Linux kernel versions across servers, containers hosts, and appliances.
- Confirm whether nf_tables support is enabled or loaded.
- Map distro package versions to the listed Linux stable fixes.
- Review kernel logs for nf_tables warnings resembling the source trace.
- Verify updated hosts boot into the remediated kernel.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit faa0deee272128b95a838fe7c6ebf6a2a426df14
- Linux stable commit 86658fc7414d4b9e25c2699d751034537503d637
- Linux stable commit e79b47a8615d42c68aaeb68971593333667382ed
- Fedora package announcement DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY
- Fedora package announcement 4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53
- Fedora package announcement GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-27012 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/faa0deee272128b95a838fe7c6ebf6a2a426df14CVE reference, Linux
- https://git.kernel.org/stable/c/86658fc7414d4b9e25c2699d751034537503d637CVE reference, Linux
- https://git.kernel.org/stable/c/e79b47a8615d42c68aaeb68971593333667382edCVE reference, Linux
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/CVE reference, CVE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/CVE reference, CVE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/CVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.