CVE-2026-64076: Linux Kernel Race Condition Vulnerability

CVE-2026-64076 Overview

CVE-2026-64076 is a race condition vulnerability in the Linux kernel's netfilter bridge eb_tables subsystem. The flaw exists in the core ebtables initialization code within ebtables.c. The initialization sequence calls nf_register_sockopt() before completing internal setup, exposing the sockopts globally before the module is fully ready. A local attacker can exploit this window to interact with partially initialized state.

Critical Impact
A local, low-privileged attacker can trigger the race during module initialization to achieve memory corruption, resulting in potential privilege escalation, kernel information disclosure, or denial of service.

Affected Products

Linux kernel — netfilter bridge ebtables subsystem (net/bridge/netfilter/ebtables.c)
Upstream Linux kernel versions prior to the fix commits
Distribution kernels shipping the affected ebtables module

Discovery Timeline

2026-07-19 - CVE-2026-64076 published to the National Vulnerability Database (NVD)
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64076

Vulnerability Analysis

The vulnerability resides in the ebtables module initialization path within the Linux kernel's bridge netfilter code. During module load, the initialization routine registers socket options via nf_register_sockopt() before all internal data structures and table registrations are complete. Once nf_register_sockopt() returns, the ebtables sockopts become globally reachable from user space through the setsockopt and getsockopt interfaces on raw sockets.

A local user holding CAP_NET_ADMIN in a namespace can invoke ebtables sockopt handlers during this narrow window. The handlers then operate on state that has not been fully initialized, resulting in undefined behavior including memory corruption and information disclosure.

This pattern mirrors historical issues fixed in ip_tables, ip6_tables, and arp_tables, where sockopt registration was moved to be the final step of initialization to prevent equivalent races.

Root Cause

The root cause is an ordering flaw in the module initialization sequence. nf_register_sockopt() publishes handlers to the global sockopt table before dependent initialization completes. This constitutes a Time-of-Check Time-of-Use (TOCTOU) style race between module load and concurrent user-space sockopt calls [CWE-362].

Attack Vector

Exploitation requires local access and low privileges. An attacker races module load by continuously issuing setsockopt/getsockopt calls with ebtables-specific option numbers against a raw socket. If a call lands after sockopt registration but before initialization completes, the handler dereferences uninitialized state. The fix reorders initialization so that nf_register_sockopt() is the final step, closing the race window.

Refer to the upstream commits 02d999dc69b3, 27414ff1b287, and c647e2a21bbb for the corrective patches.

Detection Methods for CVE-2026-64076

Indicators of Compromise

Unexpected ebtables module load events shortly followed by sockopt syscall bursts from unprivileged processes
Kernel oops or KASAN reports referencing functions in net/bridge/netfilter/ebtables.c
Anomalous crashes or panics on hosts running bridge networking with container workloads

Detection Strategies

Monitor auditd or eBPF-based telemetry for setsockopt/getsockopt calls using ebtables option numbers correlated with module load events
Track finit_module and init_module syscalls invoking ebtables from non-root user namespaces
Alert on kernel log entries containing stack traces through ebt_do_table or do_ebt_get_ctl during boot or module reload

Monitoring Recommendations

Enable kernel address sanitizer (KASAN) or lockdep in test environments to surface race-driven memory corruption
Correlate container runtime events that request CAP_NET_ADMIN with subsequent bridge netfilter activity
Ingest kernel logs into a centralized platform and build queries for ebtables-related fault signatures

How to Mitigate CVE-2026-64076

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the fix commits and rebuild affected kernels
Update distribution kernel packages to versions that include the ebtables initialization fix
Restrict CAP_NET_ADMIN in untrusted containers and user namespaces to reduce attack surface

Patch Information

The fix moves nf_register_sockopt() to be the last operation performed during ebtables initialization, matching the pattern used in ip_tables, ip6_tables, and arp_tables. The corrective changes are available in upstream commits 02d999dc69b3, 27414ff1b287, and c647e2a21bbb on kernel.org. Distribution vendors are expected to backport these patches to supported stable branches.

Workarounds

Blacklist the ebtables and ebtable_* modules on hosts that do not require bridge netfilter functionality
Disable unprivileged user namespaces via sysctl kernel.unprivileged_userns_clone=0 where policy permits
Enforce module load restrictions using modules_disabled=1 after boot on systems where dynamic loading is unnecessary

bash

# Configuration example: prevent ebtables module load
echo 'install ebtables /bin/true' | sudo tee /etc/modprobe.d/disable-ebtables.conf
echo 'blacklist ebtables' | sudo tee -a /etc/modprobe.d/disable-ebtables.conf
sudo depmod -a