CVE-2026-64077: Linux Kernel Netfilter Vulnerability

CVE-2026-64077 Overview

CVE-2026-64077 is a Linux kernel vulnerability in the netfilter subsystem, specifically in the ebtables component. The flaw stems from a race condition in the table removal path where table->ops could be exposed while the table structure was partially populated. Maintainers resolved the issue by moving ebtables to a two-stage removal scheme, mirroring earlier fixes applied to x_tables. The ebt_table struct layout is incompatible with xt helpers, so a dedicated fix was required. Local attackers with the ability to invoke ebtables operations can leverage the flaw to compromise kernel memory integrity.

Critical Impact
A local attacker with low privileges can exploit the race condition to achieve high impact on kernel confidentiality, integrity, and availability.

Affected Products

Linux kernel (upstream, versions prior to the referenced stable commits)
Distributions shipping the pre-patch netfilter/ebtables code path
Systems using ebtables for Ethernet bridge filtering

Discovery Timeline

2026-07-19 - CVE-2026-64077 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64077

Vulnerability Analysis

The vulnerability resides in the ebtables table management logic within the Linux kernel netfilter subsystem. Prior to the fix, the table removal and registration sequence permitted a window in which table->ops could be observed by concurrent code paths before the ebt_table structure was fully initialized. This exposure of a partially-filled table struct creates a race condition that concurrent readers can observe and act upon. Because ebt_table has a layout incompatible with xt_table, the existing x_tables two-stage removal helpers could not be reused, and a parallel implementation was required for ebtables.

Root Cause

The root cause is a synchronization gap in the ebtables table registration and teardown logic. The table->ops assignment occurred outside the protective scope of the ebt mutex, allowing other threads to observe an incomplete table structure. Without a two-stage removal scheme, cleanup operations could not guarantee that no readers held stale or partial references to the table before its memory was reclaimed. This is a classic time-of-check to time-of-use pattern in kernel object lifecycle management.

Attack Vector

Exploitation requires local access with the capability to invoke ebtables operations, typically CAP_NET_ADMIN within a network namespace. An attacker races table registration and removal operations across multiple threads to observe or manipulate a partially-initialized ebt_table structure. Successful exploitation can lead to use-after-free conditions, kernel memory corruption, or information disclosure, and may serve as a primitive for local privilege escalation. No user interaction or network access is required.

No public proof-of-concept code is available for CVE-2026-64077. The vulnerability mechanism is documented in the upstream patch commits referenced in the Kernel Patch Commit 739d5da, Kernel Patch Commit b7f0544, and Kernel Patch Commit ef39557.

Detection Methods for CVE-2026-64077

Indicators of Compromise

Unexpected kernel oops or panic messages referencing ebt_do_table, ebt_register_table, or ebt_unregister_table in dmesg or /var/log/kern.log.
KASAN or KFENCE reports indicating use-after-free or out-of-bounds access within net/bridge/netfilter/ebtables.c.
Anomalous invocations of ebtables administrative commands from unprivileged user contexts or containers.

Detection Strategies

Audit kernel version and package inventory to identify hosts running vulnerable netfilter/ebtables code paths.
Enable auditd rules to log invocations of setsockopt with SOL_IP and ebtables-related EBT_SO_SET_ENTRIES operations.
Monitor for repeated, high-frequency ebtables table registration or replacement calls from a single process, which is consistent with race exploitation attempts.

Monitoring Recommendations

Aggregate kernel crash telemetry and correlate stack traces containing ebtables symbols across the fleet.
Track privileged syscall activity from container workloads that possess CAP_NET_ADMIN within their network namespace.
Alert on new kernel modules loading ebtables or ebtable_* after system boot when not part of expected baseline.

How to Mitigate CVE-2026-64077

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable commits 739d5da, b7f0544, and ef39557 as soon as vendor builds are available.
Inventory all Linux hosts and container hosts running affected kernel versions and prioritize patching for multi-tenant systems.
Restrict CAP_NET_ADMIN in containers and unprivileged user namespaces where ebtables functionality is not required.

Patch Information

The fix moves ebtables to a two-stage removal scheme and performs the table->ops assignment while holding the ebt mutex, preventing exposure of partially-filled table structures. Patches are available in the mainline and stable kernel trees via Kernel Patch Commit 739d5da, Kernel Patch Commit b7f0544, and Kernel Patch Commit ef39557. Consult your distribution's security advisory for backported package versions.

Workarounds

Unload the ebtables and related bridge netfilter modules on systems that do not require Ethernet bridge filtering.
Disable user namespaces with CAP_NET_ADMIN where feasible by setting kernel.unprivileged_userns_clone=0.
Apply seccomp profiles that block setsockopt calls targeting ebtables operations from untrusted workloads.

bash

# Configuration example: remove ebtables modules and block reload
sudo rmmod ebtable_filter ebtable_nat ebtable_broute ebtables 2>/dev/null
echo "install ebtables /bin/true" | sudo tee /etc/modprobe.d/disable-ebtables.conf
sudo sysctl -w kernel.unprivileged_userns_clone=0