CVE-2026-64006
Received Received - Intake

Memory Corruption in Linux Kernel Netfilter

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix dst corruption in same register operation For lshift and rshift, the shift operations are performed in a loop over 32-bit words. The loop calculates the shifted value and write it to dst, and then immediately reads from src to calculate the carry for the next iteration. Because src and dst could point to the same memory location, the carry is incorrectly calculated using the newly modified dst value instead of the original src value. Adding a temporary local variable to cache the original value before writing to dst and using it for the carry calculation solves the problem. In addition, partial overlap is rejected from control plane for all kind of operations including byteorder. This was tested with the following bytecode: table test_table ip flags 0 use 1 handle 1 ip test_table test_chain use 3 type filter hook input prio 0 policy accept packets 0 bytes 0 flags 1 ip test_table test_chain 2 [ immediate reg 1 0x44332211 0x88776655 ] [ bitwise reg 1 = ( reg 1 << 0x08000000 ) ] [ cmp eq reg 1 0x66443322 0x00887766 ] [ counter pkts 0 bytes 0 ] ip test_table test_chain 4 3 [ immediate reg 1 0x44332211 0x88776655 ] [ bitwise reg 1 = ( reg 1 << 0x08000000 ) ] [ cmp eq reg 1 0x55443322 0x00887766 ] [ counter pkts 21794 bytes 1917798 ]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64006
EUVD
EUVD-2026-45579

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux_kernel nf_tables *
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel's netfilter nf_tables component involves incorrect handling of shift operations when the source and destination memory locations overlap. The issue occurs because the carry calculation for subsequent iterations uses the modified destination value instead of the original source value, leading to data corruption.

Detection Guidance

This vulnerability affects the Linux kernel's nf_tables component and involves dst corruption during shift operations. Detection requires checking kernel versions and nf_tables rules. Use 'uname -r' to check kernel version and 'nft list ruleset' to inspect nf_tables rules for suspicious bytecode patterns like the provided test case.

Impact Analysis

This vulnerability could allow an attacker to manipulate network packet processing rules, potentially bypassing security controls or causing denial of service. It may lead to incorrect filtering, routing, or other network operations managed by nf_tables.

Compliance Impact

This vulnerability affects compliance with standards like GDPR and HIPAA by potentially enabling unauthorized data access or manipulation through corrupted network packet processing in the Linux kernel's nf_tables. Exploitation could lead to data breaches or integrity violations, which are critical concerns under these regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the nf_tables dst corruption issue. Monitor vendor advisories for specific kernel updates addressing CVE-2026-64006.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64006. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart