Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem (netfilter) that could cause issues when unloading firewall modules. Specifically, it prevents userspace applications from correctly re-initializing network tables during certain module removal operations. This could lead to unexpected behavior in network filtering or firewall management on affected systems.
Technical details
A vulnerability in the Linux kernel's netfilter x_tables component arises from an incomplete two-stage unregistration process. When a module is removed (rmmod), a previous change to 'xtables_unregister_table_pre_exit' detached tables from the packet path but left them in a state where userspace performing set/getsockopt could not re-instantiate them. This occurred because the larval table was removed while the existing table was no longer on the active pernet list. The fix introduces 'xtables_unregister_table_exit' to properly unlink tables from the dying list, free hook operations, and handle audit notifications. This is a local reachability issue affecting kernel versions starting from 5.15.
Affected products
- Linux Linux 5.15 to 6.18.34, 7.0.11
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory