CVE-2026-64079

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: x_tables: allocate hook ops while under mutex<br /> <br /> arp/ip(6)t_register_table() add the table to the per-netns list via<br /> xt_register_table() before allocating the per-netns hook ops copy<br /> via kmemdup_array(). This leaves a window where the table is<br /> visible in the list with ops=NULL.<br /> <br /> If the pernet exit happens runs concurrently the pre_exit callback finds<br /> the table via xt_find_table() and passes the NULL ops pointer to<br /> nf_unregister_net_hooks(), causing a NULL dereference:<br /> <br /> general protection fault in nf_unregister_net_hooks+0xbc/0x150<br /> RIP: nf_unregister_net_hooks (net/netfilter/core.c:613)<br /> Call Trace:<br /> ipt_unregister_table_pre_exit<br /> iptable_mangle_net_pre_exit<br /> ops_pre_exit_list<br /> cleanup_net<br /> <br /> Fix by moving the ops allocation into the xtables core so the table is<br /> never in the list without valid ops. Also ensure the table is no longer<br /> processing packets before its torn down on error unwind.<br /> nf_register_net_hooks might have published at least one hook; call<br /> synchronize_rcu() if there was an error.<br /> <br /> audit log register message gets deferred until all operations have<br /> passed, this avoids need to emit another ureg message in case of<br /> error unwinding.<br /> <br /> Based on earlier patch by Tristan Madani.