CVE-2026-64079 Details
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: allocate hook ops while under mutex arp/ip(6)t_register_table() add the table to the per-netns list via xt_register_table() before allocating the per-netns hook ops copy via kmemdup_array(). This leaves a window where the table is visible in the list with ops=NULL. If the pernet exit happens runs concurrently the pre_exit callback finds the table via xt_find_table() and passes the NULL ops pointer to nf_unregister_net_hooks(), causing a NULL dereference: general protection fault in nf_unregister_net_hooks+0xbc/0x150 RIP: nf_unregister_net_hooks (net/netfilter/core.c:613) Call Trace: ipt_unregister_table_pre_exit iptable_mangle_net_pre_exit ops_pre_exit_list cleanup_net Fix by moving the ops allocation into the xtables core so the table is never in the list without valid ops. Also ensure the table is no longer processing packets before its torn down on error unwind. nf_register_net_hooks might have published at least one hook; call synchronize_rcu() if there was an error. audit log register message gets deferred until all operations have passed, this avoids need to emit another ureg message in case of error unwinding. Based on earlier patch by Tristan Madani.
A vulnerability in the Linux kernel's netfilter component can lead to a NULL pointer dereference, causing a general protection fault. This issue arises in the x_tables subsystem when registering ARP or IP tables. The vulnerability occurs because the table is added to the per-network namespace list before the associated hook operations are properly allocated. This creates a window where the table is visible in the list with no valid operations, and if the network namespace exit process runs concurrently, it can lead to a NULL dereference in the function that unregisters net hooks, causing a crash. The vulnerability affects several versions of the Linux kernel.
The vulnerability has been fixed by changing the order of operations in the table registration process. The hook operations are now allocated before the table is added to the network namespace list, ensuring that the table is never listed without valid operations. Users should update to the latest version of the Linux kernel where this fix has been applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/2f92c5f923979f37ab1d5445381e4b8378a196cc | kernel.org | Patch |
| https://git.kernel.org/stable/c/b62eb8dcf2c47d4d676a434efbd57c4f776f7829 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.13, < 7.0.11 7.1 rc1 7.1 rc2 7.1 rc3 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | Initial Analysis | [email protected] |
| Jul 19, 2026 | New CVE Received | kernel.org |