Skip to main content

Linux Kernel CVE-2026-64079

| EUVDEUVD-2026-45652 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-07-19 Linux GHSA-vgxq-4vm2-qmp7
Denial Of Service Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Race condition requires precise timing (AC:H); local access with low privileges needed; impact is availability-only kernel crash.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.1 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Sep 03, 2026 - 13:25 vuln.today
CVSS changed
Sep 03, 2026 - 13:22 NVD
5.5 (MEDIUM)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:39 nvd
MEDIUM 5.5
CVE Published
Jul 19, 2026 - 15:39 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

netfilter: x_tables: allocate hook ops while under mutex

arp/ip(6)t_register_table() add the table to the per-netns list via xt_register_table() before allocating the per-netns hook ops copy via kmemdup_array(). This leaves a window where the table is visible in the list with ops=NULL.

If the pernet exit happens runs concurrently the pre_exit callback finds the table via xt_find_table() and passes the NULL ops pointer to nf_unregister_net_hooks(), causing a NULL dereference:

general protection fault in nf_unregister_net_hooks+0xbc/0x150 RIP: nf_unregister_net_hooks (net/netfilter/core.c:613) Call Trace: ipt_unregister_table_pre_exit iptable_mangle_net_pre_exit ops_pre_exit_list cleanup_net

Fix by moving the ops allocation into the xtables core so the table is never in the list without valid ops. Also ensure the table is no longer processing packets before its torn down on error unwind. nf_register_net_hooks might have published at least one hook; call synchronize_rcu() if there was an error.

audit log register message gets deferred until all operations have passed, this avoids need to emit another ureg message in case of error unwinding.

Based on earlier patch by Tristan Madani.

AnalysisAI

NULL pointer dereference in the Linux kernel netfilter x_tables subsystem allows a local attacker to crash the kernel via a race condition during network namespace teardown. The flaw exists because arp/ip(6)t_register_table() adds a table to the per-netns linked list before allocating its per-namespace hook ops structure, leaving a window where ops=NULL is visible to concurrent readers. If a network namespace exit runs concurrently during this window, nf_unregister_net_hooks() receives a NULL ops pointer and triggers a general protection fault. No public exploit has been identified at time of analysis, and EPSS is very low at 0.15%.

Technical ContextAI

The vulnerability lies in the Linux kernel's netfilter xtables framework (net/netfilter/x_tables.c), which underpins iptables, ip6tables, and arptables. When a firewall table is registered for a network namespace, the table node is first linked into the per-netns list via xt_register_table(), and only afterward does kmemdup_array() allocate the per-netns hook ops copy. The CWE-476 (NULL Pointer Dereference) root cause is this TOCTOU-style race: a concurrent pernet exit path (triggered by namespace destruction) calls ipt_unregister_table_pre_exit → xt_find_table() and retrieves the half-initialized table entry, then passes its NULL ops pointer directly to nf_unregister_net_hooks(). The fix moves ops allocation into xtables core so the table is never list-visible without valid ops, and adds synchronize_rcu() on error unwind to drain any in-flight packet processing. The bug was introduced around Linux 5.13 per EUVD metadata and is confirmed in stable branches prior to 7.0.11 and 7.1.

RemediationAI

The primary fix is upgrading to Linux kernel 7.0.11 or 7.1, which contain the corrected xtables registration logic (commits 2f92c5f923979f37ab1d5445381e4b8378a196cc and b62eb8dcf2c47d4d676a434efbd57c4f776f7829 at https://git.kernel.org/stable/c/2f92c5f923979f37ab1d5445381e4b8378a196cc and https://git.kernel.org/stable/c/b62eb8dcf2c47d4d676a434efbd57c4f776f7829). Ubuntu users should apply the updates referenced in USN-8593-1 at https://ubuntu.com/security/notices/USN-8593-1. As a compensating control where patching is not immediately possible, restricting unprivileged user namespace creation (sysctl kernel.unprivileged_userns_clone=0 on systems that support it, or setting user.max_user_namespaces=0) reduces the attack surface by preventing non-root users from triggering network namespace operations; note this may break container tooling that relies on rootless namespace creation. Systems not using iptables/ip6tables/arptables kernel modules can unload or prevent loading of iptable_*, ip6table_*, and arptable_* modules (e.g., via modprobe blacklist), eliminating the affected code path entirely, though this disables host-level firewall rules.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64079 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy