In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: add and use xtables_unregister_table_exit Previous change… (CVE-2026-64078)
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: add and use xtables_unregister_table_exit Previous change added xtables_unregister_table_pre_exit to detach the table from the packetpath and to unlink it from the active table list. In case of rmmod, userspace that is doing set/getsockopt for this table will not be able to re-instantiate the table: 1. The larval table has been removed already 2. existing instantiated table is no longer on the xt pernet table list. This adds the second stage helper: unlink the table from the dying list, free the hook ops (if any) and do the audit notification. It replaces xt_unregister_table().
AI Analysis
Technical Summary
The Linux kernel netfilter x_tables subsystem previously used xtables_unregister_table_pre_exit to detach tables from the packet path and unlink them from the active table list during module removal. However, this was insufficient for complete cleanup, potentially leaving tables in a 'dying' list and causing issues for userspace attempting to re-instantiate these tables. The vulnerability was resolved by introducing xtables_unregister_table_exit, a second-stage helper that unlinks tables from the dying list, frees hook operations, and sends audit notifications, replacing the older xt_unregister_table function. This change ensures proper resource cleanup and consistent state during module unload.
Potential Impact
Improper cleanup of netfilter tables during module removal could lead to inconsistent kernel state affecting userspace applications that interact with these tables via set/getsockopt. While no direct exploit in the wild is known, the vulnerability could cause failures or unexpected behavior in network filtering operations.
Mitigation Recommendations
A fix has been implemented in the Linux kernel by adding the xtables_unregister_table_exit helper to properly clean up netfilter tables during module removal. Users should update to a Linux kernel version that includes this fix. Since this is a kernel-level fix, applying the official kernel update or patch from the vendor is the recommended remediation.
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: add and use xtables_unregister_table_exit Previous change… (CVE-2026-64078)
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: add and use xtables_unregister_table_exit Previous change added xtables_unregister_table_pre_exit to detach the table from the packetpath and to unlink it from the active table list. In case of rmmod, userspace that is doing set/getsockopt for this table will not be able to re-instantiate the table: 1. The larval table has been removed already 2. existing instantiated table is no longer on the xt pernet table list. This adds the second stage helper: unlink the table from the dying list, free the hook ops (if any) and do the audit notification. It replaces xt_unregister_table().
CVSS v3.1
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel netfilter x_tables subsystem previously used xtables_unregister_table_pre_exit to detach tables from the packet path and unlink them from the active table list during module removal. However, this was insufficient for complete cleanup, potentially leaving tables in a 'dying' list and causing issues for userspace attempting to re-instantiate these tables. The vulnerability was resolved by introducing xtables_unregister_table_exit, a second-stage helper that unlinks tables from the dying list, frees hook operations, and sends audit notifications, replacing the older xt_unregister_table function. This change ensures proper resource cleanup and consistent state during module unload.
Potential Impact
Improper cleanup of netfilter tables during module removal could lead to inconsistent kernel state affecting userspace applications that interact with these tables via set/getsockopt. While no direct exploit in the wild is known, the vulnerability could cause failures or unexpected behavior in network filtering operations.
Mitigation Recommendations
A fix has been implemented in the Linux kernel by adding the xtables_unregister_table_exit helper to properly clean up netfilter tables during module removal. Users should update to a Linux kernel version that includes this fix. Since this is a kernel-level fix, applying the official kernel update or patch from the vendor is the recommended remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-crf8-9wpw-7jgp
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64078"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27a92a4a8d598912c53b
Added to database: 07/19/2026, 19:38:17 UTC
Last enriched: 07/19/2026, 19:52:46 UTC
Last updated: 07/20/2026, 19:41:22 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.