CVE-2024-26910: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26910 affects the Linux kernel's netfilter ipset component, specifically related to a performance regression in the swap operation. The vulnerability was discovered in January 2024 and affects multiple versions of the Linux kernel up to versions 5.4.269, 5.10.210, 5.15.149, 6.1.79, and 6.6.18 (NVD).

The vulnerability stems from a race condition fix in the netfilter ipset component where synchronize_rcu() was added to the swap function. This addition unnecessarily slowed down the operation. The issue was introduced by commit 28628fa9 which fixed a race condition between swap/destroy and kernel side add/del/test operations. The CVSS v3.1 score is 4.7 (Medium) with vector: AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The primary impact of this vulnerability is a performance degradation in the ipset swap operation. While this is not a security vulnerability in the traditional sense, it affects system performance when using ipset swap operations (Kernel Patch).

This is not an exploitable security vulnerability but rather a performance issue. The condition occurs during normal operation of the ipset swap function and does not present an attack vector (NVD).

The issue has been fixed by moving the synchronize_rcu() call to the destroy function and using call_rcu() instead. The fix also includes proper handling of garbage collectors for sets with timeouts, which need to be cancelled at destroy time. The patch has been incorporated into various Linux kernel versions (Kernel Patch).