CVE-2026-64189: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64189 Overview

CVE-2026-64189 is a use-after-free vulnerability in the Linux kernel's netfilter ipset subsystem. The flaw exists in the release path of ip_set_dump_do() and ip_set_dump_done(), which read inst->ip_set_list via ip_set_ref_netlink() using a plain rcu_dereference_raw() on the array pointer. These functions execute from netlink_recvmsg() without holding the nfnl mutex and without an RCU read-side critical section. A concurrent ip_set_create() call can grow the array, publish the new one, call synchronize_net(), and then kvfree() the old array while dump paths still index into it. This race condition leads to a use-after-free that can cause kernel memory corruption or panic.

Critical Impact
Local attackers with netlink access to the ipset subsystem can trigger a use-after-free in kernel memory, potentially leading to denial of service or privilege escalation.

Affected Products

Linux kernel (netfilter ipset subsystem)
Distributions shipping kernels prior to the fix commits 7cd9103283b2, 81d54c766337, e8ee198bbc04, and ff86ea9b7fdf
Systems using ipset for netfilter-based packet filtering

Discovery Timeline

2026-07-20 - CVE-2026-64189 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64189

Vulnerability Analysis

The vulnerability is a race condition [CWE-362] resulting in a use-after-free [CWE-416] in the Linux kernel's ipset infrastructure. KASAN reports confirm the flaw with a slab-use-after-free read of size 8 in ip_set_dump_do at net/netfilter/ipset/ip_set_core.c:1697. The trace shows the invalid read originates from netlink_recvmsg() handling a dump request. Because the dump paths access the ip_set_list array pointer outside any RCU reader, the synchronize_net() call in the create path does not wait for them to complete before freeing the old array.

Root Cause

The root cause lies in improper synchronization when accessing shared state. The functions ip_set_dump_do() and ip_set_dump_done() dereference inst->ip_set_list using rcu_dereference_raw() without wrapping the access in an rcu_read_lock()/rcu_read_unlock() critical section. Meanwhile, ip_set_create() grows the array, publishes the new pointer, waits for existing readers via synchronize_net(), and frees the old array using kvfree(). Because the dump paths are not registered as RCU readers, synchronize_net() returns immediately without waiting for them, and the freed array can still be indexed.

Attack Vector

An attacker with the ability to send netlink messages to the netfilter subsystem, typically requiring CAP_NET_ADMIN within a user namespace, can trigger the race by concurrently issuing ipset dump requests and ipset create operations that force array resizing. Successful exploitation causes kernel memory corruption, leading to a general protection fault and kernel panic as shown in the KASAN report. Depending on heap layout control, memory disclosure or privilege escalation may be feasible.

No verified public exploit code is available. Technical details of the fix are published in the Kernel Git Commit Log.

Detection Methods for CVE-2026-64189

Indicators of Compromise

Kernel panic messages referencing ip_set_dump_do in net/netfilter/ipset/ip_set_core.c
KASAN slab-use-after-free reports involving the netfilter ipset subsystem
Unexplained kernel crashes on hosts running ipset with concurrent management operations
General protection faults with non-canonical addresses originating from netlink receive paths

Detection Strategies

Enable KASAN on test kernels to surface use-after-free conditions in the ipset code path
Audit systems for kernel versions predating the upstream fix commits
Monitor kernel ring buffer (dmesg) for repeated crashes tied to netfilter subsystems
Use runtime kernel telemetry to identify processes issuing frequent ipset netlink operations

Monitoring Recommendations

Collect and centralize kernel crash dumps for correlation across the fleet
Alert on unexpected kernel oops or panic events on production Linux hosts
Track privileged use of the netlink netfilter interface by unprivileged workloads or containers
Baseline ipset create and dump activity to detect anomalous concurrent operations

How to Mitigate CVE-2026-64189

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the commit list as soon as vendor builds are available
Restrict CAP_NET_ADMIN in user namespaces to limit unprivileged access to ipset operations
Audit container and workload configurations that grant netfilter management capabilities
Prioritize patching on multi-tenant systems where local users can invoke netlink

Patch Information

The fix wraps the array pointer load in rcu_read_lock()/rcu_read_unlock(), matching the pattern used in ip_set_get_byname() and __ip_set_put_byindex(). The dumped set itself remains pinned via set->ref_netlink, so only the array load required additional protection. Fix commits are available in the mainline and stable trees: 7cd9103283b26b917360ec99d7d2f2d761bcf1ab, 81d54c766337b923eec26da0a13406760b091093, e8ee198bbc04a32d336e79160fde980e0235b39f, and ff86ea9b7fdf70564e60436fbee68c96bc459943. Consult the Kernel Git Commit Log for backport details.

Workarounds

Unload the ip_set kernel module on systems that do not require it using modprobe -r ip_set
Blacklist the ip_set module in /etc/modprobe.d/ to prevent automatic loading
Remove CAP_NET_ADMIN from untrusted user namespaces and container profiles
Restrict access to the netfilter netlink family via seccomp or LSM policies

bash

# Configuration example: prevent ip_set module from loading
echo "blacklist ip_set" | sudo tee /etc/modprobe.d/blacklist-ipset.conf
sudo modprobe -r ip_set xt_set 2>/dev/null

# Verify the module is not loaded
lsmod | grep ip_set