CVE-2026-64078

Analyzed Analyzed - Analysis Complete

Kernel Module Unload Race Condition in Linux Netfilter

Publication date: 2026-07-19

Last updated on: 2026-09-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: add and use xtables_unregister_table_exit Previous change added xtables_unregister_table_pre_exit to detach the table from the packetpath and to unlink it from the active table list. In case of rmmod, userspace that is doing set/getsockopt for this table will not be able to re-instantiate the table: 1. The larval table has been removed already 2. existing instantiated table is no longer on the xt pernet table list. This adds the second stage helper: unlink the table from the dying list, free the hook ops (if any) and do the audit notification. It replaces xt_unregister_table().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-09-03

Generated

2026-09-19

AI Q&A

2026-07-19

EPSS Evaluated

2026-09-15

NVD

CVE-2026-64078

EUVD

EUVD-2026-45651

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 5.15 (inc) to 6.18.34 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the netfilter x_tables subsystem. It occurs during module removal (rmmod) where userspace processes using set/getsockopt for a table may fail to re-instantiate it because the larval table is removed prematurely and the instantiated table is no longer on the active table list.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfilter x_tables module. Detection involves checking kernel logs for errors related to x_tables or netfilter operations. Commands like dmesg | grep -i x_tables or journalctl -k | grep -i x_tables may reveal issues. Ensure your kernel version is up-to-date to avoid this problem.

Impact Analysis

If exploited, this could lead to denial of service by preventing userspace from reloading or managing netfilter tables after a module removal, potentially disrupting network filtering and security policies.

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with standards like GDPR or HIPAA. The vulnerability relates to kernel module unloading in netfilter, which could potentially disrupt network security controls if exploited. However, no explicit compliance implications are mentioned.

Mitigation Strategies

Update your Linux kernel to the latest stable version to resolve this issue. If immediate patching is not possible, avoid removing and reloading x_tables modules while userspace processes are using them. Monitor kernel logs for related errors.

Hi! I’m here to help you understand CVE-2026-64078. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70