CVE-2024-26643: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26643 affects the Linux kernel's netfilter subsystem, specifically the nf_tables component. The vulnerability was discovered in March 2024 and involves a race condition that occurs when unbinding anonymous sets with timeouts. The issue affects various Linux kernel versions and distributions including Red Hat Enterprise Linux, Ubuntu, and Debian (NVD).

The vulnerability occurs when the rhashtable set garbage collection runs asynchronously, creating a race condition that allows it to collect elements from anonymous sets with timeouts while being released from the commit path. This issue was originally reported by Mingi Cho in version 6.1.x with a pipapo set with low timeouts. The problem was addressed by setting the dead flag for anonymous sets to skip async garbage collection in this case (Kernel Commit).

While the exact severity rating has not been published in the NVD, the vulnerability has been classified as having a moderate security impact by Red Hat. The issue could potentially lead to system instability or denial of service conditions due to the race condition in memory management (Red Hat Advisory).

The vulnerability requires specific conditions involving anonymous sets with timeouts in the netfilter subsystem. It was discovered in a controlled testing environment and there are no public reports of this vulnerability being exploited in the wild (NVD).

The issue has been fixed in various Linux kernel versions through patches that modify the nf_tables_api.c file to set the dead flag when unbinding anonymous sets with timeouts. System administrators should apply the appropriate kernel updates provided by their distribution vendors. The fix has been backported to multiple kernel versions and is available through distribution-specific security updates (Ubuntu Notice, Red Hat Advisory).