CVE-2026-64079
Received Received - Intake

Race Condition in Linux Kernel Netfilter X_tables Leading to NULL Pointer Dereference

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: allocate hook ops while under mutex arp/ip(6)t_register_table() add the table to the per-netns list via xt_register_table() before allocating the per-netns hook ops copy via kmemdup_array(). This leaves a window where the table is visible in the list with ops=NULL. If the pernet exit happens runs concurrently the pre_exit callback finds the table via xt_find_table() and passes the NULL ops pointer to nf_unregister_net_hooks(), causing a NULL dereference: general protection fault in nf_unregister_net_hooks+0xbc/0x150 RIP: nf_unregister_net_hooks (net/netfilter/core.c:613) Call Trace: ipt_unregister_table_pre_exit iptable_mangle_net_pre_exit ops_pre_exit_list cleanup_net Fix by moving the ops allocation into the xtables core so the table is never in the list without valid ops. Also ensure the table is no longer processing packets before its torn down on error unwind. nf_register_net_hooks might have published at least one hook; call synchronize_rcu() if there was an error. audit log register message gets deferred until all operations have passed, this avoids need to emit another ureg message in case of error unwinding. Based on earlier patch by Tristan Madani.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64079
EUVD
EUVD-2026-45652

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the netfilter x_tables subsystem. When registering an ARP/IP(6) table, the table is added to a per-network namespace list before allocating the required hook operations. This creates a window where the table is visible but has NULL operations. If a pernet exit occurs concurrently, it can trigger a NULL dereference in nf_unregister_net_hooks, leading to a general protection fault.

Detection Guidance

This vulnerability involves a NULL pointer dereference in the Linux kernel's netfilter subsystem. Detection requires checking kernel logs for general protection faults related to nf_unregister_net_hooks or ipt_unregister_table_pre_exit. Monitor system logs with commands like dmesg | grep -i "general protection fault" or journalctl -k | grep -i "nf_unregister_net_hooks"

Impact Analysis

This vulnerability can cause system crashes due to a NULL pointer dereference, leading to kernel panic and denial of service. Attackers could exploit this to disrupt network filtering operations, potentially bypassing security controls or causing instability in systems relying on netfilter for packet processing.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel issue causing a NULL dereference in the netfilter subsystem. Compliance impacts would only occur if exploitation led to system instability or unauthorized access, which is not described in the provided context.

Mitigation Strategies

Apply the latest kernel security updates provided by your Linux distribution. If immediate patching is not possible, consider disabling affected netfilter modules or restricting network operations until the update is applied. Monitor vendor advisories for specific mitigation steps.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64079. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart