Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem (Netfilter) that could cause a system crash. The issue occurs when the system incorrectly handles internal tables used for firewalling and network address translation during specific cleanup operations. This could lead to a 'denial of service' where the entire operating system stops responding or restarts unexpectedly.
Technical details
A race condition exists in netfilter's x_tables during table registration. The functions arp/ip(6)t_register_table() add a table to the per-network namespace list via xt_register_table() before the corresponding hook operations are allocated via kmemdup_array(). If a network namespace exit occurs concurrently, the pre_exit callback (e.g., ipt_unregister_table_pre_exit) may find the table in the list while its 'ops' pointer is still NULL. This NULL pointer is then passed to nf_unregister_net_hooks(), resulting in a general protection fault. The fix involves moving the allocation into the xtables core to ensure atomicity relative to the list visibility.
Affected products
- Linux Linux Kernel 5.13 to 7.0.11
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory