CVE-2026-64078 (GCVE-0-2026-64078)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:39 – Updated: 2026-08-05 12:38
VLAI
Title
netfilter: x_tables: add and use xtables_unregister_table_exit
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: add and use xtables_unregister_table_exit Previous change added xtables_unregister_table_pre_exit to detach the table from the packetpath and to unlink it from the active table list. In case of rmmod, userspace that is doing set/getsockopt for this table will not be able to re-instantiate the table: 1. The larval table has been removed already 2. existing instantiated table is no longer on the xt pernet table list. This adds the second stage helper: unlink the table from the dying list, free the hook ops (if any) and do the audit notification. It replaces xt_unregister_table().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fdacd57c79b79a03c7ca88f706ad9fb7b46831c1 , < 86ee5bc9c0f0e652e19f395675a432de11b75514 (git)
Affected: fdacd57c79b79a03c7ca88f706ad9fb7b46831c1 , < 8026e5163cca1d1db436c7bfb89ddea8b5e8c2cf (git)
Affected: fdacd57c79b79a03c7ca88f706ad9fb7b46831c1 , < b4597d5fd7d2f8cebfffd40dffb5e003cc78964c (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.18.34 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/netfilter/x_tables.h",
            "net/ipv4/netfilter/arp_tables.c",
            "net/ipv4/netfilter/ip_tables.c",
            "net/ipv4/netfilter/iptable_nat.c",
            "net/ipv6/netfilter/ip6_tables.c",
            "net/ipv6/netfilter/ip6table_nat.c",
            "net/netfilter/x_tables.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "86ee5bc9c0f0e652e19f395675a432de11b75514",
              "status": "affected",
              "version": "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1",
              "versionType": "git"
            },
            {
              "lessThan": "8026e5163cca1d1db436c7bfb89ddea8b5e8c2cf",
              "status": "affected",
              "version": "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1",
              "versionType": "git"
            },
            {
              "lessThan": "b4597d5fd7d2f8cebfffd40dffb5e003cc78964c",
              "status": "affected",
              "version": "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/netfilter/x_tables.h",
            "net/ipv4/netfilter/arp_tables.c",
            "net/ipv4/netfilter/ip_tables.c",
            "net/ipv4/netfilter/iptable_nat.c",
            "net/ipv6/netfilter/ip6_tables.c",
            "net/ipv6/netfilter/ip6table_nat.c",
            "net/netfilter/x_tables.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: add and use xtables_unregister_table_exit\n\nPrevious change added xtables_unregister_table_pre_exit to detach the\ntable from the packetpath and to unlink it from the active table list.\nIn case of rmmod, userspace that is doing set/getsockopt for this table\nwill not be able to re-instantiate the table:\n 1. The larval table has been removed already\n 2. existing instantiated table is no longer on the xt pernet table list.\n\nThis adds the second stage helper:\n\nunlink the table from the dying list, free the hook ops (if any) and do\nthe audit notification.  It replaces xt_unregister_table()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local iptables/arptables setsockopt/getsockopt on `IPPROTO_IP`/`IPPROTO_IPV6` sockets (`do_ipt_set_ctl`/`do_ipt_get_ctl`), not by processing remote network packets.\nAC:L - Exploitation is a race between concurrent setsockopt traffic and netns teardown or `rmmod`; the attacker controls both sides (one thread hammering iptables, another deleting the netns or unloading the module) and can retry until the window is hit.\nPR:L - All vulnerable paths require `CAP_NET_ADMIN` in the target network namespace (`ns_capable(sock_net(sk)-\u003euser_ns, CAP_NET_ADMIN)`), which an unprivileged user can obtain inside a user/network namespace via `unshare`.\nUI:N - No victim interaction is required beyond the attacker\u2019s own namespace lifecycle and iptables syscalls.\nS:U - Impact is confined to kernel memory corruption/privilege impact within the same kernel security domain; it is not a cross-VM or cross-container boundary escape.\nC:H - The teardown race leaves `xt_table`/`xt_table_info` reachable via setsockopt while `pre_exit`/`exit` frees them, creating a classic kernel heap use-after-free that can be turned into arbitrary memory disclosure.\nI:H - Concurrent `xt_replace_table()` against a table being torn down can corrupt or replace freed `xt_table_info` memory, enabling arbitrary kernel writes and potential privilege escalation.\nA:H - The race during `cleanup_net` or module unload can trigger kernel oops/panic from use-after-free or leave tables in an unrecoverable broken state affecting system availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:58.654Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/86ee5bc9c0f0e652e19f395675a432de11b75514"
        },
        {
          "url": "https://git.kernel.org/stable/c/8026e5163cca1d1db436c7bfb89ddea8b5e8c2cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4597d5fd7d2f8cebfffd40dffb5e003cc78964c"
        }
      ],
      "title": "netfilter: x_tables: add and use xtables_unregister_table_exit",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64078",
    "datePublished": "2026-07-19T15:39:51.582Z",
    "dateReserved": "2026-07-19T07:54:57.031Z",
    "dateUpdated": "2026-08-05T12:38:58.654Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64078",
      "date": "2026-09-20",
      "epss": "0.00127",
      "percentile": "0.02739"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-13T00:02:38.000Z",
      "cve": "CVE-2026-64078",
      "id": "msrc_CVE-2026-64078",
      "initial_release_date": "2026-07-21T01:02:56.000Z",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "netfilter: x_tables: add and use xtables_unregister_table_exit",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64078.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/linux/netfilter/x_tables.h",
                  "net/ipv4/netfilter/arp_tables.c",
                  "net/ipv4/netfilter/ip_tables.c",
                  "net/ipv4/netfilter/iptable_nat.c",
                  "net/ipv6/netfilter/ip6_tables.c",
                  "net/ipv6/netfilter/ip6table_nat.c",
                  "net/netfilter/x_tables.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "86ee5bc9c0f0e652e19f395675a432de11b75514",
                    "status": "affected",
                    "version": "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8026e5163cca1d1db436c7bfb89ddea8b5e8c2cf",
                    "status": "affected",
                    "version": "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b4597d5fd7d2f8cebfffd40dffb5e003cc78964c",
                    "status": "affected",
                    "version": "fdacd57c79b79a03c7ca88f706ad9fb7b46831c1",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/linux/netfilter/x_tables.h",
                  "net/ipv4/netfilter/arp_tables.c",
                  "net/ipv4/netfilter/ip_tables.c",
                  "net/ipv4/netfilter/iptable_nat.c",
                  "net/ipv6/netfilter/ip6_tables.c",
                  "net/ipv6/netfilter/ip6table_nat.c",
                  "net/netfilter/x_tables.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.34",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1111B859-7CF3-4F75-8724-625922494032",
                    "versionEndExcluding": "6.18.34",
                    "versionStartIncluding": "5.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750",
                    "versionEndExcluding": "7.0.11",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: add and use xtables_unregister_table_exit\n\nPrevious change added xtables_unregister_table_pre_exit to detach the\ntable from the packetpath and to unlink it from the active table list.\nIn case of rmmod, userspace that is doing set/getsockopt for this table\nwill not be able to re-instantiate the table:\n 1. The larval table has been removed already\n 2. existing instantiated table is no longer on the xt pernet table list.\n\nThis adds the second stage helper:\n\nunlink the table from the dying list, free the hook ops (if any) and do\nthe audit notification.  It replaces xt_unregister_table()."
          }
        ],
        "id": "CVE-2026-64078",
        "lastModified": "2026-09-03T14:32:51.083",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:48.407",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8026e5163cca1d1db436c7bfb89ddea8b5e8c2cf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/86ee5bc9c0f0e652e19f395675a432de11b75514"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b4597d5fd7d2f8cebfffd40dffb5e003cc78964c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T13:33:33+00:00",
      "cve": "CVE-2026-64078",
      "id": "CVE-2026-64078",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "199",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: x_tables: add and use xtables_unregister_table_exit",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64078.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:56:15Z",
      "cve": "CVE-2026-64078",
      "id": "CVE-2026-64078",
      "initial_release_date": "2026-07-21T13:00:06Z",
      "product_status:known_affected": "123",
      "product_status:known_not_affected": "251",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64078",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64078.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.