CVE-2026-63858 Overview
CVE-2026-63858 is a Linux kernel vulnerability in the netfilter subsystem, specifically within the nf_tables component. The flaw stems from improper handling of hook deletions during device removal operations. The previous implementation moved hooks from the basechain or flowtable hook_list to a transaction hook_list during the preparation phase, breaking netlink dump path readers of this RCU-protected list.
A local authenticated attacker with the ability to interact with nf_tables can trigger unsafe list manipulation, leading to memory corruption or race conditions during concurrent netlink dumps.
Critical Impact
Local attackers with low privileges can exploit this kernel-level flaw to compromise confidentiality, integrity, and availability of affected Linux systems.
Affected Products
- Linux Kernel (upstream, versions prior to the fix commits)
- Linux distributions shipping vulnerable stable kernel branches
- Systems using netfilternf_tables with basechain or flowtable device hooks
Discovery Timeline
- 2026-07-19 - CVE-2026-63858 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-63858
Vulnerability Analysis
The vulnerability resides in the netfilter: nf_tables subsystem, which manages packet filtering rules through basechains and flowtables. When a device tied to a hook is deleted, the kernel prepares a transaction to remove the associated hook. The previous approach moved the hook from the basechain or flowtable hook_list into a transaction hook_list during this preparation phase.
This mutation of an RCU-protected list breaks concurrent readers walking the list from the netlink dump path. Readers may observe inconsistent list state, dereference stale pointers, or trigger memory corruption. The fix reintroduces the NFT_HOOK_REMOVE flag to indicate a hook is going away and adds a new nft_trans_hook transaction object to track deletions without altering the original hook_list during preparation.
Root Cause
The root cause is unsafe manipulation of an RCU-protected linked list. RCU semantics require that readers observe a consistent view of the list without synchronization, but the deletion logic mutated the list before the transaction was committed. This violates RCU invariants and creates a race condition between netlink dump readers and device deletion writers.
Attack Vector
Exploitation requires local access with low privileges sufficient to interact with nf_tables through netlink, typically CAP_NET_ADMIN within a user or network namespace. An attacker triggers concurrent device deletion and netlink dump operations to race the hook list mutation against RCU readers. Successful exploitation can lead to kernel memory corruption, information disclosure, or denial of service.
No public exploit code or proof-of-concept has been published for CVE-2026-63858. Technical details are available in the upstream kernel commits at Linux Kernel Commit 10f79dbd7719 and Linux Kernel Commit 4e69bfb32b2d.
Detection Methods for CVE-2026-63858
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing nf_tables, nft_hook, or netfilter in dmesg and /var/log/kern.log.
- Kernel warnings related to RCU list corruption or use-after-free during netlink operations.
- Unusual nft command activity from non-administrative user or network namespaces.
Detection Strategies
- Monitor kernel logs for stack traces originating in nf_tables_netdev or nft_chain_del paths.
- Audit processes invoking netlink operations against the NETLINK_NETFILTER family, correlating with device deletion events.
- Track creation and deletion of network namespaces by unprivileged processes, which is a common precondition for nf_tables race exploitation.
Monitoring Recommendations
- Enable kernel auditing (auditd) for netlink syscalls and nf_tables administrative operations.
- Deploy AppArmor or SELinux policies restricting CAP_NET_ADMIN within unprivileged containers.
- Aggregate kernel telemetry into a centralized log platform for correlation across hosts.
How to Mitigate CVE-2026-63858
Immediate Actions Required
- Apply the upstream kernel patches referenced in the stable tree commits 10f79dbd7719 and 4e69bfb32b2d.
- Update to a distribution kernel that incorporates the fixed nf_tables hook transaction logic.
- Restrict CAP_NET_ADMIN in untrusted containers and user namespaces where feasible.
Patch Information
The fix restores the NFT_HOOK_REMOVE flag and introduces nft_trans_hook transaction objects to track hook deletions without mutating the basechain or flowtable hook_list during the preparation phase. The event notification path was also adapted to iterate the new list of hook transactions. Patches are available at Linux Kernel Commit 10f79dbd7719 and Linux Kernel Commit 4e69bfb32b2d.
Workarounds
- Disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0 where the workload allows.
- Restrict access to nf_tables netlink operations through seccomp filters on container runtimes.
- Remove CAP_NET_ADMIN from workloads that do not require dynamic firewall configuration.
# Configuration example: disable unprivileged user namespaces
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' >> /etc/sysctl.d/99-hardening.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
