CVE-2026-64079: netfilter: x_tables: allocate hook ops while under mutex
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xtables: allocate hook ops while under mutex
arp/ip(6)tregistertable() add the table to the per-netns list via xtregistertable() before allocating the per-netns hook ops copy via kmemduparray(). This leaves a window where the table is visible in the list with ops=NULL.
If the pernet exit happens runs concurrently the preexit callback finds the table via xtfindtable() and passes the NULL ops pointer to nfunregisternethooks(), causing a NULL dereference:
general protection fault in nfunregisternethooks+0xbc/0x150 RIP: nfunregisternethooks (net/netfilter/core.c:613) Call Trace: iptunregistertablepreexit iptablemanglenetpreexit opspreexitlist cleanupnet
Fix by moving the ops allocation into the xtables core so the table is never in the list without valid ops. Also ensure the table is no longer processing packets before its torn down on error unwind. nfregisternethooks might have published at least one hook; call synchronizercu() if there was an error.
audit log register message gets deferred until all operations have passed, this avoids need to emit another ureg message in case of error unwinding.
Based on earlier patch by Tristan Madani.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply the x_tables fix concept described: ensure table hook ops are allocated while under the netfilter/xtables core mutex and that the per-netns list never exposes tables with ops=NULL (so the per-netns pre_exit callback cannot encounter a NULL ops pointer during concurrent net namespace exit/unwind).
Event History
Frequently Asked Questions
What conditions are required to trigger the failure?
The issue requires a local, low-privileged actor or process to trigger concurrent netfilter x_tables table registration and network-namespace teardown. The race occurs when a table has been added to the per-network-namespace list before its hook-operations copy has been allocated.
What is the practical impact if the race is hit?
Network-namespace cleanup can find a table whose ops pointer is NULL and pass it to nf_unregister_net_hooks(), causing a NULL-pointer dereference and general protection fault. The CVSS vector indicates an availability impact only, with no stated confidentiality or integrity impact.
What does the fix change?
The fix allocates hook operations within the x_tables core before the table can be visible without valid ops. It also synchronizes RCU during error cleanup when hook registration may have published hooks, ensuring packet processing has stopped before teardown.