CVE-2026-64410
Received Received - Intake

BaseFortify

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: IPIP tunnel hardware offload is not yet support No driver supports for IPIP tunnels yet, give up early on setting up the hardware offload for this scenario. This patch adds a stub that can be enhanced to add more configuration that are currently not supported. As of now, the offload work is enqueued to the worker, then ignored if the hardware offload configuration is not supported. Check the NF_FLOW_HW flag to know if this entry was already tried once to be offloaded so this is not retried on refresh when unsupported. Move NF_FLOW_HW flag check to nf_flow_offload_add(). If this NF_FLOW_HW flag is unset the _del and _stats variants are never called. This can be updated later on to skip hardware offload work to be queued in case hardware offload does not support it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64410
EUVD
EUVD-2026-48954

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel relates to a missing feature in hardware offloading for IPIP tunnels. The kernel attempts to set up hardware offloading for IPIP tunnels but fails because no drivers support this feature yet. The system handles this by enqueuing the offload work to a worker thread, which then ignores it if hardware offloading is unsupported. A flag (NF_FLOW_HW) is used to prevent repeated attempts to offload unsupported configurations.

Detection Guidance

This vulnerability is related to IPIP tunnel hardware offload in the Linux kernel. Detection involves checking if the NF_FLOW_HW flag is set in netfilter flowtable entries. Use commands like 'dmesg | grep -i flowtable' or 'cat /proc/net/nf_flowtable' to inspect flowtable entries and hardware offload status.

Impact Analysis

This vulnerability may cause performance overhead due to unnecessary processing of unsupported hardware offload attempts for IPIP tunnels. It does not introduce security risks but could lead to inefficiencies in network traffic handling if the system repeatedly tries to offload unsupported configurations.

Mitigation Strategies

Since this is a kernel-level issue with no driver support for IPIP tunnel hardware offload, mitigation involves disabling hardware offload for IPIP tunnels. Update the kernel to a patched version if available. Monitor kernel logs for flowtable errors and avoid using IPIP tunnel hardware offload features.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64410. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart