Linux Kernel Netfilter Vulnerability Rated 7.8 CVSS

Status: UPDATED  |  Advisory ID: CVE-2026-63858

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: add hook transactions for device deletions

Restore the flag that indicates that the hook is going away, ie.

NFT_HOOK_REMOVE, but add a new transaction object to track deletion

of hooks without altering the basechain/flowtable hook_list during

the preparation phase.

The existing approach that moves the hook from the basechain/flowtable

hook_list to transaction hook_list breaks netlink dump path readers

of this RCU-protected list.

It should be possible use an array for nft_trans_hook to store the

deleted hooks to compact the representation but I am not expecting

many hook object, specially now that wildcard support for devices

is in place.

Note that the nft_trans_chain_hooks() list contains a list of struct

nft_trans_hook objects for DELCHAIN and DELFLOWTABLE commands, while

this list stores struct nft_hook objects for NEWCHAIN and NEWFLOWTABLE.

Note that new commands can be updated to use nft_trans_hook for

consistency.

This patch also adapts the event notification path to deal with the list

of hook transactions. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References