CVE-2026-64006: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64006 Overview

CVE-2026-64006 is a memory corruption vulnerability in the Linux kernel's netfilter subsystem, specifically in the nf_tables component. The flaw exists in the shift operations (lshift and rshift) of the bitwise expression, where source and destination registers can point to the same memory location. When shift operations execute in a loop over 32-bit words, the carry calculation reads from the already-modified destination instead of the original source, corrupting the result. The issue affects packet filtering behavior and rule evaluation in nftables.

Critical Impact
Register corruption in nf_tables shift operations can produce incorrect packet matching decisions, potentially bypassing firewall rules or causing unintended traffic handling in kernels using nftables.

Affected Products

Linux kernel (mainline) with netfilternf_tables subsystem
Distributions shipping vulnerable nftables kernel modules
Systems using nft_bitwise shift operations in ruleset configurations

Discovery Timeline

2026-07-19 - CVE-2026-64006 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64006

Vulnerability Analysis

The vulnerability resides in the nf_tables bitwise expression handler that implements left-shift (lshift) and right-shift (rshift) operations. These operations process register data as an array of 32-bit words within a loop. Each iteration computes the shifted value, writes it to the destination register, and then reads from the source register to derive the carry bits used in the next iteration.

When a user configures a rule where the source and destination registers reference the same memory location, this read-after-write pattern breaks correctness. The carry calculation consumes the freshly written destination bytes rather than the original source data, producing an incorrect final value. The provided test bytecode demonstrates the divergence between expected and observed results when shifting the value 0x88776655_44332211 by 0x08000000 bits with matching source and destination registers.

Root Cause

The root cause is an ordering flaw between destination writes and source reads inside the shift loop. The code assumes src and dst refer to distinct buffers, but nf_tables permits register aliasing where both operands share the same storage. Additionally, partial overlap between register operands was not rejected by the control plane for shift and byteorder operations, allowing malformed rulesets to trigger the corruption.

Attack Vector

Exploitation requires the ability to install nftables rules, which typically demands CAP_NET_ADMIN in the relevant network namespace. On systems with user namespaces enabled, unprivileged local users may reach this code path. The attacker crafts a bitwise shift rule where source and destination registers alias, causing packet evaluation logic to produce attacker-influenced incorrect values. This can lead to firewall rule misbehavior or influence downstream packet handling decisions.

The upstream fix introduces a temporary local variable to cache the original source word before writing to the destination, ensuring the carry calculation always uses the original data. The control plane was additionally hardened to reject partial register overlap for all operations, including byteorder.

Detection Methods for CVE-2026-64006

Indicators of Compromise

Unexpected nftables rule evaluation outcomes where shift-based bitwise matches produce inconsistent packet counters
Kernel audit logs showing installation of nft_bitwise rules with identical source and destination register identifiers
Presence of Linux kernel versions predating commits 18014147, 96bea2a7, a391afe7, or b80ef316

Detection Strategies

Inventory running kernels across the fleet and compare against patched stable releases containing the nf_tables fix commits
Audit deployed nftables rulesets with nft list ruleset to identify use of shift operations and evaluate register usage patterns
Monitor for privilege-granting operations that expose CAP_NET_ADMIN to untrusted workloads, including containers with elevated capabilities or unprivileged user namespaces

Monitoring Recommendations

Enable kernel audit rules for nftables netlink configuration events (NFT_MSG_NEWRULE) to log rule installations
Track anomalous firewall traffic patterns, particularly unexpected accepts or drops that correlate with recent ruleset changes
Alert on user-namespace creation from non-privileged processes on hosts where this capability is not required

How to Mitigate CVE-2026-64006

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 18014147, 96bea2a7, a391afe7, and b80ef316 via the vendor kernel update channel
Restrict CAP_NET_ADMIN and disable unprivileged user namespaces on hosts where nftables rule installation by non-root users is not required
Review existing nftables rulesets for shift operations that reuse the same register as source and destination

Patch Information

The fix was merged upstream across multiple stable kernel branches. Refer to the Kernel Git Commit 18014147, Kernel Git Commit 96bea2a7, Kernel Git Commit a391afe7, and Kernel Git Commit b80ef316. The patch caches the original source word in a temporary variable prior to writing the destination, and rejects partially overlapping registers at the control plane.

Workarounds

Disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0 on distributions that expose this sysctl
Remove or refactor nftables rules that perform bitwise shift operations on aliased registers until the kernel patch is applied
Constrain container workloads to drop CAP_NET_ADMIN unless explicitly required for network configuration

bash

# Configuration example: disable unprivileged user namespaces
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' >> /etc/sysctl.d/99-harden.conf

# Verify installed kernel version against patched stable releases
uname -r