VulnerabilityPublished 19 Jul 2026Updated 21 Oct 2026

CVE-2026-64006: Linux kernel · netfilter: nf_tables: fix dst corruption in same register operation

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in b80ef316e978de2ef81d5bee9c19800b4cf96fb8 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:30 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.1% chance of exploitation in 30 days – higher than 2% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in b80ef316e978de2ef81d5bee9c19800b4cf96fb8, a391afe74398b70107f111aa731eab608624949d, 18014147d3ee7831dce53fe65d7fc8d428b02552 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 19 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 567d746b55bc66d3800c9ae91d50f0c5deb2fd93, < b80ef316e978de2ef81d5bee9c19800b4cf96fb8	Fixed in b80ef316e978de2ef81d5bee9c19800b4cf96fb8
LinuxLinux	Affected ≥ 567d746b55bc66d3800c9ae91d50f0c5deb2fd93, < a391afe74398b70107f111aa731eab608624949d	Fixed in a391afe74398b70107f111aa731eab608624949d
LinuxLinux	Affected ≥ 567d746b55bc66d3800c9ae91d50f0c5deb2fd93, < 18014147d3ee7831dce53fe65d7fc8d428b02552	Fixed in 18014147d3ee7831dce53fe65d7fc8d428b02552
LinuxLinux	Affected ≥ 567d746b55bc66d3800c9ae91d50f0c5deb2fd93, < 379ff8d40f59632bea1208956629c2a04067d403	Fixed in 379ff8d40f59632bea1208956629c2a04067d403
LinuxLinux	Affected ≥ 567d746b55bc66d3800c9ae91d50f0c5deb2fd93, < 96bea2a7baac4a1137c188dc7610184487ab30a7	Fixed in 96bea2a7baac4a1137c188dc7610184487ab30a7
LinuxLinux	Affected =5.6	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix dst corruption in same register operation For lshift and rshift, the shift operations are performed in a loop over 32-bit words. The loop calculates the shifted value and write it to dst, and then immediately reads from src to calculate the carry for the next iteration. Because src and dst could point to the same memory location, the carry is incorrectly calculated using the newly modified dst value instead of the original src value. Adding a temporary local variable to cache the original value before writing to dst and using it for the carry calculation solves the problem. In addition, partial overlap is rejected from control plane for all kind of operations including byteorder. This was tested with the following bytecode: table test_table ip flags 0 use 1 handle 1 ip test_table test_chain use 3 type filter hook input prio 0 policy accept packets 0 bytes 0 flags 1 ip test_table test_chain 2 [ immediate reg 1 0x44332211 0x88776655 ] [ bitwise reg 1 = ( reg 1 << 0x08000000 ) ] [ cmp eq reg 1 0x66443322 0x00887766 ] [ counter pkts 0 bytes 0 ] ip test_table test_chain 4 3 [ immediate reg 1 0x44332211 0x88776655 ] [ bitwise reg 1 = ( reg 1 << 0x08000000 ) ] [ cmp eq reg 1 0x55443322 0x00887766 ] [ counter pkts 21794 bytes 1917798 ]

References

Community reviews

Loading reviews…