The vulnerability (CVE-2026-64189) in the Linux kernel's netfilter ipset arises from a race condition between the dump operation and resizing of the ip_set_list array. The dump functions ip_set_dump_do() and ip_set_dump_done() read the ip_set_list pointer without holding the necessary RCU read-side critical section or the nfnl mutex. Concurrent ip_set_create() calls can resize the array, publishing a new array and freeing the old one after synchronize_net(). Because the dump path does not hold an RCU read lock, synchronize_net() does not wait for it, resulting in a use-after-free when the dump code accesses the freed array. This can cause kernel memory corruption detected by KASAN, leading to kernel panics or crashes. The fix involves adding rcu_read_lock() around the array access to ensure proper synchronization.

This vulnerability can cause use-after-free memory corruption in the kernel, potentially leading to kernel panics or system crashes. There is no indication of remote code execution or privilege escalation in the provided data. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description states it has been resolved, implying a fix is available in the Linux kernel source. Users should update to the fixed kernel version once released by their distribution or vendor. Until then, no specific mitigations are provided.