CVE-2026-64410: Linux Kernel Netfilter Vulnerability

CVE-2026-64410 Overview

CVE-2026-64410 affects the Linux kernel's netfilter flowtable subsystem. The issue involves improper handling of hardware offload configuration for IP-in-IP (IPIP) tunnels. No current driver supports IPIP tunnel hardware offload, yet the kernel enqueues offload work for these unsupported scenarios. The fix introduces an early stub that gives up on hardware offload setup for IPIP tunnels and uses the NF_FLOW_HW flag to prevent repeated retry attempts on refresh.

Critical Impact
The vulnerability exists in the Linux kernel's network filtering hardware offload path, which processes network traffic. Kernel maintainers have released patches to correct the flowtable offload behavior.

Affected Products

Linux kernel (netfilter flowtable subsystem)
Systems configuring hardware offload for IPIP tunnels via nftables flowtables
Distributions shipping affected upstream kernel versions prior to the referenced fix commits

Discovery Timeline

2026-07-25 - CVE-2026-64410 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64410

Vulnerability Analysis

The vulnerability resides in the netfilter flowtable hardware offload code path within the Linux kernel. Flowtables accelerate connection tracking by offloading flow state to compatible network hardware. The subsystem attempted to configure hardware offload for IPIP tunnel entries even though no driver currently supports this configuration.

The upstream fix adds a stub that returns early when an IPIP tunnel offload is requested. The patch also relocates the NF_FLOW_HW flag check into nf_flow_offload_add() so that _del and _stats variants are never invoked for entries that were never successfully offloaded. This prevents redundant work from being enqueued on refresh.

Root Cause

The root cause is missing input validation in the flowtable hardware offload dispatcher. The code path did not verify whether the underlying driver supports IPIP tunnel offload before enqueuing work to the offload worker. As a result, unsupported configurations reached execution paths that assumed valid driver support, and refresh cycles repeatedly retried the same unsupported operation.

Attack Vector

The issue is triggered through network-facing configuration of nftables flowtables that reference IPIP tunnel interfaces. According to the referenced advisory data, the attack surface is exposed on systems that use netfilter flowtables with hardware offload enabled on IPIP tunnel devices. Refer to the upstream commits at Kernel.org Commit 6c5dcab and Kernel.org Commit 9efe838c for the exact code paths modified.

No public proof-of-concept, exploit code, or CISA KEV listing exists for this CVE at time of publication. Technical details are limited to the upstream kernel commit descriptions.

Detection Methods for CVE-2026-64410

Indicators of Compromise

No public indicators of compromise have been published for this vulnerability.
Unusual kernel log messages related to nf_flow_offload_add, flowtable workers, or IPIP tunnel offload failures may indicate exposure to the affected code path.

Detection Strategies

Inventory Linux kernel versions across the fleet and identify hosts running kernels prior to the fix commits 6c5dcab and 9efe838c.
Audit nftables configurations for flowtable declarations that reference IPIP tunnel interfaces with the offload flag enabled.
Monitor kernel ring buffer output via dmesg for repeated flowtable offload errors tied to tunnel devices.

Monitoring Recommendations

Collect kernel logs centrally and alert on netfilter or flowtable-related error patterns.
Track kernel package versions through configuration management tooling and flag hosts running vulnerable versions.
Monitor changes to nftables rulesets that introduce flowtable offload against tunnel interfaces.

How to Mitigate CVE-2026-64410

Immediate Actions Required

Apply the upstream kernel patches referenced in Kernel.org Commit 6c5dcab and Kernel.org Commit 9efe838c or install distribution updates that include these fixes.
Reboot affected hosts after kernel upgrade to activate the patched code.
Review nftables flowtable configurations and remove hardware offload directives from IPIP tunnel interfaces until patches are applied.

Patch Information

The fix is committed upstream in the Linux kernel stable tree. Two commits address the issue: 6c5dcab95f4cd42a1648739ec9300fbb4b1a021f and 9efe838c13133acb70c78d04c49e8362fe533566. Distribution vendors will backport these commits into their supported kernel branches. Consult your Linux distribution's security advisories for the specific package versions containing the fix.

Workarounds

Disable hardware offload on flowtables that reference IPIP tunnel interfaces until the kernel patch is deployed.
Avoid adding IPIP tunnel devices to flowtable blocks with the offload flag in nftables rulesets.
Restrict configuration of netfilter flowtables to administrators through standard Linux capability controls.

bash

# Example: nftables flowtable without offload on tunnel interfaces
# Remove or comment out any 'flags offload;' line for flowtables that
# include IPIP tunnel devices until the patched kernel is installed.
table inet filter {
    flowtable ft {
        hook ingress priority 0;
        devices = { eth0 };
        # flags offload;  # keep disabled where tunnel devices are involved
    }
}