---
id: CVE-2024-26835
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nf_tables: set dormant flag on hook register failure

  We need to set the dormant flag again if we fail to register
  the hooks.

  During memory pressure hook re…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nf_tables: set dormant flag on hook register failure

  We need to set the dormant flag again if we fail to register
  the hooks.

  During memory pressure hook re…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.4.262, < 5.4.270'
  - 'linux_kernel >= 5.10.202, < 5.10.211'
  - 'linux_kernel >= 5.13, < 5.15.150'
  - 'linux_kernel >= 5.16, < 6.1.80'
  - 'linux_kernel >= 6.2, < 6.6.19'
  - 'linux_kernel >= 6.7, < 6.7.7'
  - linux_kernel = 6.8
  - debian_linux = 10.0
patched:
  - linux_kernel 6.7.7
published: '2024-04-17'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:17:25.077'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-26835'
references:
  - url: 'https://git.kernel.org/stable/c/0c9302a6da262e6ab6a6c1d30f04a6130ed97376'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/31ea574aeca1aa488e18716459bde057217637af'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/664264a5c55bf97a9c571c557d477b75416199be'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6f2496366426cec18ba53f1c7f6c3ac307ca6a95'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a6411f3c48f991c19aaf9a24fce36865fbba28d7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ae4360cbd385f0d7a8a86d5723e50448cc6318f3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bccebf64701735533c8db37773eeacc6566cc8ec'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f2135bbf14949687e96cabb13d8a91ae3deb9069'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0c9302a6da262e6ab6a6c1d30f04a6130ed97376'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/31ea574aeca1aa488e18716459bde057217637af'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/664264a5c55bf97a9c571c557d477b75416199be'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/6f2496366426cec18ba53f1c7f6c3ac307ca6a95'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/a6411f3c48f991c19aaf9a24fce36865fbba28d7'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/ae4360cbd385f0d7a8a86d5723e50448cc6318f3'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/bccebf64701735533c8db37773eeacc6566cc8ec'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/f2135bbf14949687e96cabb13d8a91ae3deb9069'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-613116.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00233
epssPercentile: 0.14117
ingestedAt: '2026-10-15T03:30:12.651Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-09-10T15:48:51.357992Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: set dormant flag on hook register failure

We need to set the dormant flag again if we fail to register
the hooks.

During memory pressure hook registration can fail and we end up
with a table marked as active but no registered hooks.

On table/base chain deletion, nf_tables will attempt to unregister
the hook again which yields a warn splat from the nftables core.

## Affected

- `linux_kernel >= 5.4.262, < 5.4.270`
- `linux_kernel >= 5.10.202, < 5.10.211`
- `linux_kernel >= 5.13, < 5.15.150`
- `linux_kernel >= 5.16, < 6.1.80`
- `linux_kernel >= 6.2, < 6.6.19`
- `linux_kernel >= 6.7, < 6.7.7`
- `linux_kernel = 6.8`
- `debian_linux = 10.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.7.7`