CVE-2024-26834: 
Linux Debian vulnerability analysis and mitigation

CVE-2024-26834 affects the Linux kernel's netfilter component, specifically in the nft_flow_offload functionality. The vulnerability was discovered and reported by Florian Westphal and was fixed in February 2024. The issue involves a memory leak in the direct transmit path where the destination (dst) object is not properly released when dev_queue_xmit() is called to send packets (Kernel Git).

The vulnerability occurs in the net/netfilter/nf_flow_table_core.c file where a destination object is not properly released in the direct transmit path. The issue was identified through kmemleak which reported an unreferenced object of size 184 bytes. The bug was traced through a backtrace that showed the call chain through various netfilter and networking subsystem functions, including nft_flow_route, nft_flow_offload_eval, and ip_forward. The fix involves adding a dst_release(dst) call in the appropriate code path (Kernel Git).

The vulnerability results in a memory leak in the Linux kernel's netfilter subsystem. When the direct transmit path is used, memory allocated for destination routing information is not properly freed, leading to resource exhaustion over time (Kernel Git).

The vulnerability requires access to the netfilter subsystem and specifically affects the flow offload functionality. It appears to be a resource exhaustion issue rather than a security boundary bypass. No active exploits have been reported in the wild (Kernel Git).

The issue has been fixed in the Linux kernel through a patch that adds proper destination object cleanup. The fix was committed by Pablo Neira Ayuso and has been backported to various stable kernel versions. Users should update to patched kernel versions that include the fix (Kernel Git).