Linux Kernel CVE-2026-63858

Exploitation requires local access with the ability to administer nf_tables over netlink - effectively CAP_NET_ADMIN in the relevant network namespace, which on many distributions an unprivileged user can obtain by creating a user namespace. The concrete trigger is deleting device hooks from a basechain or flowtable (NEWCHAIN/DELCHAIN or NEWFLOWTABLE/DELFLOWTABLE handling) while a concurrent netlink dump reads the RCU-protected hook_list, so success also requires winning a timing race against that reader. Limiting factors: no remote vector (AV:L requires a local foothold), some privilege is required (PR:L, not unauthenticated), the affected kernel versions must be running without the backported fix, and reliability is constrained by the race window; hardened systems that disable unprivileged user namespaces meaningfully raise the bar. There is no user-interaction requirement (UI:N).

The signals are internally consistent and point to a real but not urgent kernel-local issue. The CVSS vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 7.8) reflects local, low-privilege access with high impact typical of a kernel UAF; however, the described defect is fundamentally a timing race against netlink dump readers, which in practice makes reliable exploitation harder than the vendor's AC:L suggests - a more defensible complexity rating is AC:H. Exploitation-probability signals are low and non-alarming: EPSS 0.14% (4th percentile), not listed in CISA KEV, and no public POC identified. The 'Information Disclosure' tag aligns with the RCU-reader corruption (kernel memory leak), though a UAF of this kind can also enable integrity/availability impact up to privilege escalation, so the C:H/I:H/A:H rating is plausible. Net: prioritize as a routine-to-elevated kernel patch - meaningful because netfilter is ubiquitous and reachable from unprivileged user namespaces, but not an emergency given no active exploitation and race-dependent triggering.

A local attacker with netfilter admin rights - for example an unprivileged user who spawns a user namespace granting CAP_NET_ADMIN, or a compromised container process - repeatedly creates and deletes basechain/flowtable device hooks while concurrently issuing netlink dump requests. By winning the race against the RCU dump reader they force access to freed hook memory, leaking kernel data or corrupting kernel state as a stepping stone to privilege escalation. No public exploit is currently identified, and success depends on reliably hitting the timing window.