CVE-2026-64079

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: x_tables: allocate hook ops while under mutex

arp/ip(6)t_register_table() add the table to the per-netns list via

xt_register_table() before allocating the per-netns hook ops copy

via kmemdup_array(). This leaves a window where the table is

visible in the list with ops=NULL.

If the pernet exit happens runs concurrently the pre_exit callback finds

the table via xt_find_table() and passes the NULL ops pointer to

nf_unregister_net_hooks(), causing a NULL dereference:

general protection fault in nf_unregister_net_hooks+0xbc/0x150

RIP: nf_unregister_net_hooks (net/netfilter/core.c:613)

Call Trace:

ipt_unregister_table_pre_exit

iptable_mangle_net_pre_exit

ops_pre_exit_list

cleanup_net

Fix by moving the ops allocation into the xtables core so the table is

never in the list without valid ops. Also ensure the table is no longer

processing packets before its torn down on error unwind.

nf_r

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References