CVE-2026-64150: Linux Kernel Race Condition Vulnerability

CVE-2026-64150 Overview

CVE-2026-64150 is a Linux kernel vulnerability in the netfilter subsystem, specifically within the nft_inner module. The flaw involves an incorrect locking order in the error path where local_bh_enable() is called before local_unlock_nested_bh(), violating the expected release sequence of the local lock and softirq state. This ordering issue can trigger kernel lock imbalance and integrity issues in packet inspection paths handled by nftables inner header matching. The Linux kernel maintainers have addressed the defect through three upstream commits in stable branches.

Critical Impact
Improper locking order in nft_inner error handling can lead to kernel state corruption reachable through crafted network traffic processed by nftables rules.

Affected Products

Linux kernel versions containing the nft_inner netfilter module with the affected locking sequence
Distributions shipping kernels prior to the fixes referenced in commits 6fecd39, a6cb3ff, and df19b6a
Systems using nftables with inner header matching for tunneled traffic inspection

Discovery Timeline

2026-07-19 - CVE-2026-64150 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64150

Vulnerability Analysis

The defect resides in the netfilter nft_inner module, which parses inner headers of tunneled packets for nftables rule evaluation. The Linux kernel uses paired primitives to protect per-CPU state: local_lock_nested_bh() acquires a nested BH-safe local lock, and local_bh_disable() disables softirq processing. The correct release order requires calling local_unlock_nested_bh() before local_bh_enable().

In the affected error path, this order is reversed. Softirqs are re-enabled while the nested BH local lock is still held, breaking the locking contract expected by the kernel's preemption and locking validators. On kernels with PROVE_LOCKING or PREEMPT_RT, this triggers assertion failures. In production kernels, it can result in inconsistent per-CPU state and unsafe reentrancy into netfilter processing while a lock is still asserted.

Root Cause

The root cause is an ordering bug in cleanup code where lock release primitives are invoked in the wrong sequence. Because nft_inner runs in the packet processing hot path with softirqs disabled, prematurely re-enabling softirqs before releasing the nested local lock creates a window where softirq handlers can execute against inconsistent lock state.

Attack Vector

The module processes inner headers of encapsulated packets received from the network. An attacker able to send crafted tunneled traffic to a host running nftables rules that reference inner header matching can force the error path in nft_inner, triggering the incorrect release sequence. Repeated triggering can degrade kernel stability and expose additional race windows.

No public proof-of-concept has been published. Technical details are available in the upstream fix commits 6fecd39c6401, a6cb3ff97985, and df19b6af1716 in the Linux stable kernel tree.

Detection Methods for CVE-2026-64150

Indicators of Compromise

Kernel log entries containing lockdep warnings referencing nft_inner, local_lock, or bh_enable imbalance
Softirq-related WARN_ON splats in dmesg originating from net/netfilter/nft_inner.c
Unexpected kernel panics or soft lockups on hosts processing high volumes of tunneled traffic through nftables

Detection Strategies

Audit installed kernel package versions against distribution advisories referencing the three fix commits
Enable CONFIG_PROVE_LOCKING on test kernels to surface the ordering violation during nftables inner match evaluation
Correlate netfilter-related kernel warnings with nftables rule sets that use inner expressions for tunneled protocols such as VXLAN or GENEVE

Monitoring Recommendations

Forward kernel ring buffer output to a centralized log store and alert on lockdep or softirq imbalance messages
Monitor host availability metrics for firewall and gateway systems that terminate tunnels and apply nftables inspection
Track kernel package inventory to identify unpatched hosts still exposed to the flaw

How to Mitigate CVE-2026-64150

Immediate Actions Required

Identify all hosts running kernels that include the nft_inner module and apply nftables rules to tunneled traffic
Schedule updates to a kernel version incorporating the fixes from commits 6fecd39, a6cb3ff, and df19b6a
Restrict administrative access to nftables rule management on affected hosts until patches are deployed

Patch Information

The fix reorders the release primitives so local_unlock_nested_bh() is called before local_bh_enable() in the error path. Merged fixes are available in the following upstream commits:

Apply the kernel update provided by your Linux distribution vendor that references these commits, then reboot to activate the corrected module.

Workarounds

Remove nftables rules that use inner header matching expressions until the kernel is patched
Terminate tunnel decapsulation on a separate, patched host to shield vulnerable systems from crafted encapsulated traffic
Where feasible, drop unexpected tunneled protocols at network ingress to reduce the reachable attack surface

bash

# Verify running kernel and check for nft_inner usage
uname -r
sudo nft list ruleset | grep -i inner

# After distribution patch is installed, reboot to load the fixed kernel
sudo reboot