CVE-2026-64079: Linux Kernel Race Condition Vulnerability

CVE-2026-64079 Overview

CVE-2026-64079 is a race condition vulnerability in the Linux kernel's netfilter x_tables subsystem. The flaw resides in the arp/ip(6)t_register_table() code path, which registers a table in the per-network-namespace list before allocating its per-netns hook operations copy. This ordering creates a window where the table is visible with a NULL ops pointer. A concurrent pernet exit path can dereference this NULL pointer, leading to a kernel crash. The issue was resolved by moving the ops allocation into the xtables core so tables never appear in the list without valid ops.

Critical Impact
A concurrent pernet exit callback can invoke nf_unregister_net_hooks() with a NULL ops pointer, triggering a general protection fault in the kernel.

Affected Products

Linux kernel (netfilter x_tables subsystem)
Kernel builds using iptable_mangle, ip6table, and arptable modules
Distributions shipping affected upstream kernel versions prior to the fix commits

Discovery Timeline

2026-07-19 - CVE-2026-64079 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64079

Vulnerability Analysis

The vulnerability is a race condition [CWE-362] in the netfilter x_tables registration logic. The functions arpt_register_table(), ipt_register_table(), and ip6t_register_table() call xt_register_table() to add a new table to the per-namespace list before invoking kmemdup_array() to allocate the per-netns hook ops copy. During the interval between these two operations, the table structure is discoverable via xt_find_table() but its ops field remains NULL.

If a network namespace teardown runs concurrently, the pre_exit callback path (ipt_unregister_table_pre_exit → iptable_mangle_net_pre_exit → ops_pre_exit_list → cleanup_net) locates the partially initialized table and passes the NULL ops pointer to nf_unregister_net_hooks(). The result is a general protection fault at nf_unregister_net_hooks+0xbc/0x150 in net/netfilter/core.c:613.

Root Cause

The root cause is an incorrect operation ordering under insufficient mutex coverage. The table becomes globally visible before its hook operations array is populated. The fix relocates the ops allocation into the xtables core so allocation completes while still holding the mutex. This guarantees the table is never inserted into the per-netns list without valid ops.

Attack Vector

Exploitation requires local capability to trigger network namespace creation and teardown operations, typically requiring CAP_NET_ADMIN in a user namespace. The attacker races table registration against namespace cleanup. Successful triggering causes a kernel NULL pointer dereference resulting in denial of service. The fix additionally calls synchronize_rcu() on error unwind paths where nf_register_net_hooks may have already published a hook, ensuring no packets are still being processed during teardown.

See the upstream fix commit 2f92c5f9 and companion commit b62eb8dc for the complete patch series.

Detection Methods for CVE-2026-64079

Indicators of Compromise

Kernel crash logs containing general protection fault in nf_unregister_net_hooks+0xbc/0x150
Call traces referencing ipt_unregister_table_pre_exit, iptable_mangle_net_pre_exit, or ops_pre_exit_list
Unexpected kernel oops entries in dmesg or /var/log/kern.log during container or namespace teardown

Detection Strategies

Monitor kernel ring buffer for oops and general protection fault entries referencing netfilter symbols
Audit workloads that rapidly create and destroy network namespaces, such as container orchestrators, for abnormal crash patterns
Track kernel version inventory across hosts to identify systems running vulnerable builds prior to the fix commits

Monitoring Recommendations

Forward kern.log and journald kernel messages to a centralized logging pipeline and alert on nf_unregister_net_hooks faults
Enable kdump on production Linux hosts to capture crash dumps for post-incident forensic analysis
Correlate namespace lifecycle events from container runtimes with kernel fault timestamps

How to Mitigate CVE-2026-64079

Immediate Actions Required

Identify hosts running kernel versions prior to the fix commits and prioritize them for update
Restrict CAP_NET_ADMIN and unprivileged user namespace creation on multi-tenant systems where feasible
Deploy vendor kernel updates from your distribution as they become available through standard channels

Patch Information

The fix is available in the upstream stable tree via commits 2f92c5f923979f37ab1d5445381e4b8378a196cc and b62eb8dcf2c47d4d676a434efbd57c4f776f7829. The patch moves hook ops allocation into the xtables core under the mutex, adds synchronize_rcu() on error paths, and defers the audit register message until all operations complete successfully.

Workarounds

Disable unprivileged user namespaces via sysctl kernel.unprivileged_userns_clone=0 where the workload permits
Limit the ability of untrusted processes to load or manipulate netfilter tables through seccomp or Landlock policies
Avoid workloads that concurrently register netfilter tables while destroying network namespaces on unpatched hosts

bash

# Verify kernel version and check for the fix
uname -r

# Restrict unprivileged user namespaces (workaround)
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' | sudo tee -a /etc/sysctl.d/99-cve-2026-64079.conf

# Apply distribution kernel update
sudo apt update && sudo apt upgrade linux-image-$(uname -r | cut -d- -f3-)