CVE-2026-64079netfilter: x_tables: allocate hook ops while under mutex
- 5.5MediumCVSS base score
- 0.12%Exploitation in 30 daysEPSS · top 98% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: allocate hook ops while under mutex arp/ip(6)t_register_table() add the table to the per-netns list via xt_register_table() before allocating the per-netns hook ops copy via kmemdup_array(). This leaves a window where the table is visible in the list with ops=NULL. If the pernet exit happens runs concurrently the pre_exit callback finds the table via xt_find_table() and passes the NULL ops pointer to nf_unregister_net_hooks(), causing a NULL dereference: general protection fault in nf_unregister_net_hooks+0xbc/0x150 RIP: nf_unregister_net_hooks (net/netfilter/core.c:613) Call Trace: ipt_unregister_table_pre_exit iptable_mangle_net_pre_exit ops_pre_exit_list cleanup_net Fix by moving the ops allocation into the xtables core so the table is never in the list without valid ops. Also ensure the table is no longer processing packets before its torn down on error unwind. nf_register_net_hooks might have published at least one hook; call synchronize_rcu() if there was an error. audit log register message gets deferred until all operations have passed, this avoids need to emit another ureg message in case of error unwinding. Based on earlier patch by Tristan Madani.
Timeline
ID reserved
By Linux
Published
- 4 months later
· 4 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.12% · top 98% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected ae689334225ff0e4ef112459ecd24aea932c2b00 – < 5ea15e78232253e657d352e625fb4913e2f57e63
- affected ae689334225ff0e4ef112459ecd24aea932c2b00 – < 693bffd742dd4fa9a0076ed120545af3679c588b
- affected ae689334225ff0e4ef112459ecd24aea932c2b00 – < f669571a2bf5067f50091cc598df9613663ee226
- affected ae689334225ff0e4ef112459ecd24aea932c2b00 – < 2f92c5f923979f37ab1d5445381e4b8378a196cc
- affected ae689334225ff0e4ef112459ecd24aea932c2b00 – < b62eb8dcf2c47d4d676a434efbd57c4f776f7829
- affected 5.13
- unaffected < 5.13
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.114 – ≤ 6.12.*
- unaffected 6.18.57 – ≤ 6.18.*
- unaffected 7.0.11 – ≤ 7.0.*
- unaffected 7.1 – ≤ *
References
References5
- https://git.kernel.org/stable/c/5ea15e78232253e657d352e625fb4913e2f57e63 (opens in a new tab)
- https://git.kernel.org/stable/c/693bffd742dd4fa9a0076ed120545af3679c588b (opens in a new tab)
- https://git.kernel.org/stable/c/f669571a2bf5067f50091cc598df9613663ee226 (opens in a new tab)
- https://git.kernel.org/stable/c/2f92c5f923979f37ab1d5445381e4b8378a196cc (opens in a new tab)
- https://git.kernel.org/stable/c/b62eb8dcf2c47d4d676a434efbd57c4f776f7829 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-45652 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-64079)Record last updated .