CVE-2026-64079

A flaw was found in the Linux kernel's netfilter x_tables component. A race condition occurs when a network namespace (netns) table is registered, making it visible with a null operations (ops) pointer. If a pernet exit operation runs concurrently, it can attempt to unregister the table using this null pointer, leading to a null dereference. This vulnerability can be exploited by a local attacker to cause a Denial of Service (DoS) by crashing the system.

x_tables table registration has a race where a table can become visible in the per netns table list before its hook ops pointer is initialized. A concurrent pernet exit path can find that table and pass a NULL ops pointer to nf_unregister_net_hooks, causing a NULL pointer dereference and kernel crash. The same registration and error unwind area also contains an RCU lifetime concern because nf_register_net_hooks may publish a hook before failing, so a packet path could still observe hook state while teardown proceeds. For the CVSS the PR:L is used for the paranoid score because reliable triggering requires local code or a local process able to create and tear down network namespaces or otherwise exercise xtables registration, but this may be available to unprivileged users on systems with user namespaces or delegated container networking. The issue is not directly network reachable and is triggered through the netfilter control plane rather than packet traffic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.