PT-2026-61396 · Linux · Linux
CVE-2026-64079
·
Published
2026-07-19
·
Updated
2026-07-19
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
netfilter: x tables: allocate hook ops while under mutex
arp/ip(6)t register table() add the table to the per-netns list via
xt register table() before allocating the per-netns hook ops copy
via kmemdup array(). This leaves a window where the table is
visible in the list with ops=NULL.
If the pernet exit happens runs concurrently the pre exit callback finds
the table via xt find table() and passes the NULL ops pointer to
nf unregister net hooks(), causing a NULL dereference:
general protection fault in nf unregister net hooks+0xbc/0x150
RIP: nf unregister net hooks (net/netfilter/core.c:613)
Call Trace:
ipt unregister table pre exit
iptable mangle net pre exit
ops pre exit list
cleanup net
Fix by moving the ops allocation into the xtables core so the table is
never in the list without valid ops. Also ensure the table is no longer
processing packets before its torn down on error unwind.
nf register net hooks might have published at least one hook; call
synchronize rcu() if there was an error.
audit log register message gets deferred until all operations have
passed, this avoids need to emit another ureg message in case of
error unwinding.
Based on earlier patch by Tristan Madani.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux