CVE-2026-64189

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: fix race between dump and ip_set_list resize

The release path of ip_set_dump_do() and ip_set_dump_done() read

inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw()

of the array pointer. These run from netlink_recvmsg() without the nfnl

mutex and without an RCU read-side critical section.

A concurrent ip_set_create() can grow the array: it publishes the new

array, calls synchronize_net() and then kvfree()s the old one. Since the

dump paths read the array outside any RCU reader, synchronize_net() does

not wait for them and the old array can be freed while they still index

into it, causing a use-after-free.

The dumped set itself stays pinned via set->ref_netlink, so only the

array load needs protecting. Take rcu_read_lock() around it, matching

ip_set_get_byname() and __ip_set_put_byindex().

BUG: KASAN: slab-use-after-free in ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:169

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References