CVE-2026-64189

A flaw was found in the Linux kernel's netfilter ipset component. A race condition exists between the ip_set_list resize operation and dump operations. This can lead to a use-after-free vulnerability, where memory is accessed after it has been deallocated. A successful exploitation of this flaw could result in a kernel panic, effectively causing a Denial of Service (DoS) on the system.

A race condition in netfilter ipset can occur when the dump release path reads inst ip_set_list while a concurrent ip_set_create operation resizes and frees the old array. The dump path uses ip_set_ref_netlink without an RCU read side critical section, so synchronize_net does not protect it and the old array can be freed while it is still indexed. This leads to a slab use-after-free in ip_set_dump_do and can crash the kernel through a general protection fault or panic. For the CVSS the PR:L is used for the paranoid score because a local user with delegated network administration rights, container root, or user namespace based CAP_NET_ADMIN may be able to drive the required ipset netlink operations without being full host root. The issue is not directly reachable from remote packet traffic and is triggered through local netfilter control plane operations. Impact is at least local denial of service. In worst case it may allow confidentiality or integrity impact due to a race based use-after-free and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.