CVE-2026-63858

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: add hook transactions for device deletions

Restore the flag that indicates that the hook is going away, ie.

NFT_HOOK_REMOVE, but add a new transaction object to track deletion

of hooks without altering the basechain/flowtable hook_list during

the preparation phase.

The existing approach that moves the hook from the basechain/flowtable

hook_list to transaction hook_list breaks netlink dump path readers

of this RCU-protected list.

It should be possible use an array for nft_trans_hook to store the

deleted hooks to compact the representation but I am not expecting

many hook object, specially now that wildcard support for devices

is in place.

Note that the nft_trans_chain_hooks() list contains a list of struct

nft_trans_hook objects for DELCHAIN and DELFLOWTABLE commands, while

this list stores struct nft_hook objects for NEWCHAIN and NEWFLOWTABLE.

Note that new commands can be updated to use nft_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References