CVE-2026-64078: Linux Kernel Netfilter Table Vulnerability

CVE-2026-64078 Overview

CVE-2026-64078 is a Linux kernel vulnerability in the netfilterx_tables subsystem. The flaw involves incorrect table lifecycle management during module unload (rmmod) operations. When userspace performs setsockopt or getsockopt calls on a table being torn down, the kernel can access memory in an inconsistent state. The fix introduces a two-stage unregistration path: xtables_unregister_table_pre_exit detaches the table from the packet path and the active table list, while a new helper xtables_unregister_table_exit unlinks the table from the dying list, frees hook operations, and emits audit notifications.

Critical Impact
A local, authenticated user with the ability to interact with x_tables sockets during module unload can trigger kernel memory corruption leading to privilege escalation or denial of service.

Affected Products

Linux kernel versions prior to the commits referenced in the upstream fix
Distributions shipping vulnerable stable kernel branches that include the netfilterx_tables subsystem
Systems with iptables, ip6tables, arptables, or ebtables modules loaded

Discovery Timeline

2026-07-19 - CVE-2026-64078 published to the National Vulnerability Database (NVD)
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64078

Vulnerability Analysis

The x_tables subsystem manages netfilter tables such as filter, nat, mangle, and raw. Each table has a lifecycle tied to its owning module. Before this fix, xt_unregister_table() performed both packet-path detachment and final cleanup as a single operation. When a module was removed with rmmod, userspace processes concurrently issuing setsockopt or getsockopt on the table could race with the teardown. The larval table had already been removed, and the existing instantiated table was no longer on the xt per-net table list, leaving the socket path with references to a table transitioning through cleanup.

The upstream resolution splits unregistration into two phases. The pre-exit phase detaches the table from packet processing and the active list. The new xtables_unregister_table_exit completes teardown by unlinking from the dying list, freeing hook operations, and issuing the audit notification. This ordering prevents concurrent socket handlers from operating on a partially freed table.

Root Cause

The root cause is improper synchronization between table unregistration and userspace socket option handlers. The single-stage xt_unregister_table() did not provide a safe intermediate state, creating a window where socket paths could reference tables in an inconsistent lifecycle stage. This is a kernel resource management flaw closely related to use-after-free and race condition classes.

Attack Vector

Exploitation requires local access with sufficient privileges to load or unload netfilter modules or to issue setsockopt/getsockopt calls against x_tables. An attacker with CAP_NET_ADMIN in a user namespace, which is available to unprivileged users on many distributions, can race socket option calls against module unload to reach the corrupted state. Successful exploitation may yield kernel memory corruption, information disclosure, or elevation of privilege. The vulnerability is not remotely exploitable.

The vulnerability mechanism is described in commit messages available in the upstream fix. See the Kernel Git Commit 8026e51, Kernel Git Commit 86ee5bc, and Kernel Git Commit b4597d5 for the patch series.

Detection Methods for CVE-2026-64078

Indicators of Compromise

Unexpected rmmod or modprobe -r events targeting ip_tables, ip6_tables, arp_tables, or ebtables modules on production hosts
Kernel oops or general protection fault entries in dmesg referencing xt_unregister_table or netfilter table teardown paths
Audit records showing setsockopt/getsockopt activity on netfilter sockets concurrent with module unload events
Processes with CAP_NET_ADMIN in user namespaces performing repeated netfilter table registration cycles

Detection Strategies

Enable auditd rules on the init_module, delete_module, and finit_module syscalls to capture module lifecycle changes
Correlate netfilter socket option calls with module unload events across the same process tree
Monitor /proc/modules and kernel ring buffer output for repeated load and unload cycles of x_tables modules
Deploy EDR telemetry that captures kernel crash artifacts and unexpected privilege transitions from local users

Monitoring Recommendations

Alert on any non-administrative process invoking delete_module or interacting with /proc/net/ip_tables_names
Track kernel version and patch level across the fleet to identify hosts running vulnerable builds
Log and review use of unprivileged user namespaces, since they expose CAP_NET_ADMIN to standard users
Baseline normal netfilter administration activity to make anomalous racing behavior easier to spot

How to Mitigate CVE-2026-64078

Immediate Actions Required

Apply the vendor-supplied kernel update that includes the xtables_unregister_table_exit helper as soon as it is available for your distribution
Restrict CAP_NET_ADMIN by disabling unprivileged user namespaces where operational requirements allow: sysctl -w kernel.unprivileged_userns_clone=0
Limit which users and services can load or unload kernel modules through modules_disabled once boot-time module loading is complete
Audit systems for local users with shell access and revoke unnecessary local accounts

Patch Information

The fix is upstream in the Linux kernel through three commits: 8026e51, 86ee5bc, and b4597d5. These add xtables_unregister_table_pre_exit and xtables_unregister_table_exit and update netfilter table modules to use the two-stage teardown. Refer to the Kernel Git Commit 8026e51, Kernel Git Commit 86ee5bc, and Kernel Git Commit b4597d5 and consult your distribution's stable kernel advisories for backported builds.

Workarounds

Set kernel.modules_disabled=1 after all required modules are loaded to prevent runtime unload of x_tables modules
Disable unprivileged user namespaces with sysctl kernel.unprivileged_userns_clone=0 on distributions that expose this tunable
Use nftables where feasible and unload legacy x_tables modules only during maintenance windows with no untrusted local users active
Apply Mandatory Access Control policies (SELinux, AppArmor) that block non-root processes from opening netfilter sockets

bash

# Configuration example
# Prevent further module unload after boot completes
sysctl -w kernel.modules_disabled=1

# Restrict unprivileged access to CAP_NET_ADMIN via user namespaces
sysctl -w kernel.unprivileged_userns_clone=0

# Persist the settings
cat <<'EOF' >> /etc/sysctl.d/99-cve-2026-64078.conf
kernel.unprivileged_userns_clone=0
EOF