CVE-2026-63858 (GCVE-0-2026-63858)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:04 – Updated: 2026-08-05 12:36
VLAI
Title
netfilter: nf_tables: add hook transactions for device deletions
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: add hook transactions for device deletions Restore the flag that indicates that the hook is going away, ie. NFT_HOOK_REMOVE, but add a new transaction object to track deletion of hooks without altering the basechain/flowtable hook_list during the preparation phase. The existing approach that moves the hook from the basechain/flowtable hook_list to transaction hook_list breaks netlink dump path readers of this RCU-protected list. It should be possible use an array for nft_trans_hook to store the deleted hooks to compact the representation but I am not expecting many hook object, specially now that wildcard support for devices is in place. Note that the nft_trans_chain_hooks() list contains a list of struct nft_trans_hook objects for DELCHAIN and DELFLOWTABLE commands, while this list stores struct nft_hook objects for NEWCHAIN and NEWFLOWTABLE. Note that new commands can be updated to use nft_trans_hook for consistency. This patch also adapts the event notification path to deal with the list of hook transactions.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b6d9014a3335194590abdd2a2471ef5147a67645 , < 4e69bfb32b2db323d9205fdb30e284481b37817c (git)
Affected: b6d9014a3335194590abdd2a2471ef5147a67645 , < 10f79dbd7719d1da9f5884d13060322d8729f091 (git)
Affected: 7a248f9c74f9f62799718c12efd9e9e391d60b6f (git)
Affected: f275989ad04159dbfc62cefb65ba9c5ba1d7c34f (git)
Affected: 62d91062058b42bf70b2c3446aec397bb0ce15ee (git)
Affected: 99180dec5ae582227219d1fdd0dd5ccf53ec7491 (git)
Affected: 5.10.122 , < 5.11 (semver)
Affected: 5.15.47 , < 5.16 (semver)
Affected: 5.17.15 , < 5.18 (semver)
Affected: 5.18.4 , < 5.19 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 7.0.10 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_tables.h",
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4e69bfb32b2db323d9205fdb30e284481b37817c",
              "status": "affected",
              "version": "b6d9014a3335194590abdd2a2471ef5147a67645",
              "versionType": "git"
            },
            {
              "lessThan": "10f79dbd7719d1da9f5884d13060322d8729f091",
              "status": "affected",
              "version": "b6d9014a3335194590abdd2a2471ef5147a67645",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7a248f9c74f9f62799718c12efd9e9e391d60b6f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f275989ad04159dbfc62cefb65ba9c5ba1d7c34f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "62d91062058b42bf70b2c3446aec397bb0ce15ee",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "99180dec5ae582227219d1fdd0dd5ccf53ec7491",
              "versionType": "git"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.122",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.47",
              "versionType": "semver"
            },
            {
              "lessThan": "5.18",
              "status": "affected",
              "version": "5.17.15",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19",
              "status": "affected",
              "version": "5.18.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_tables.h",
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.122",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.47",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.17.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.18.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: add hook transactions for device deletions\n\nRestore the flag that indicates that the hook is going away, ie.\nNFT_HOOK_REMOVE, but add a new transaction object to track deletion\nof hooks without altering the basechain/flowtable hook_list during\nthe preparation phase.\n\nThe existing approach that moves the hook from the basechain/flowtable\nhook_list to transaction hook_list breaks netlink dump path readers\nof this RCU-protected list.\n\nIt should be possible use an array for nft_trans_hook to store the\ndeleted hooks to compact the representation but I am not expecting\nmany hook object, specially now that wildcard support for devices\nis in place.\n\nNote that the nft_trans_chain_hooks() list contains a list of struct\nnft_trans_hook objects for DELCHAIN and DELFLOWTABLE commands, while\nthis list stores struct nft_hook objects for NEWCHAIN and NEWFLOWTABLE.\nNote that new commands can be updated to use nft_trans_hook for\nconsistency.\n\nThis patch also adapts the event notification path to deal with the list\nof hook transactions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reachable only through local Netlink syscalls to the nf_tables subsystem (NFT_MSG_DELCHAIN/DELFLOWTABLE hook deletion racing with GETCHAIN/GETFLOWTABLE dumps), which per kernel CNA guidance is Attack Vector Local, not network-reachable.\nAC:L - The attacker controls both sides of the race by opening concurrent Netlink sockets\u2014one issuing hook-deletion batch commands and another issuing chain/flowtable dumps\u2014making successful triggering reliably achievable without conditions outside attacker control.\nPR:L - All nf_tables Netlink operations require CAP_NET_ADMIN checked in nfnetlink_rcv(), which is obtainable by an unprivileged user via user namespaces (unshare -Urn), so privileges required are Low rather than High.\nUI:N - Exploitation requires no victim interaction; the attacker triggers the race entirely through their own concurrent Netlink requests without needing another user to perform any action.\nS:U - Impact remains within the kernel\u0027s security authority (kernel crash, memory corruption, potential local privilege escalation) rather than crossing a distinct security boundary such as VM guest-to-host escape.\nC:H - RCU list corruption yields a bogus nft_hook pointer that dereferences arbitrary kernel memory (e.g., reading hook-\u003eifname from stack-local or freed memory), constituting arbitrary kernel memory read potential consistent with High confidentiality impact.\nI:H - The corrupted list traversal produces invalid struct nft_hook pointers via container_of(), enabling heap/stack memory corruption that can be leveraged for arbitrary write or control-flow hijacking, warranting High integrity impact.\nA:H - The race reliably causes kernel oops/panic from dereferencing bogus nft_hook pointers during concurrent Netlink dumps, and the underlying RCU list corruption can crash or hang the system, giving High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:37.055Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4e69bfb32b2db323d9205fdb30e284481b37817c"
        },
        {
          "url": "https://git.kernel.org/stable/c/10f79dbd7719d1da9f5884d13060322d8729f091"
        }
      ],
      "title": "netfilter: nf_tables: add hook transactions for device deletions",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63858",
    "datePublished": "2026-07-19T14:04:46.967Z",
    "dateReserved": "2026-07-19T07:54:57.016Z",
    "dateUpdated": "2026-08-05T12:36:37.055Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63858",
      "date": "2026-09-20",
      "epss": "0.00123",
      "percentile": "0.02418"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-13T00:17:24.000Z",
      "cve": "CVE-2026-63858",
      "id": "msrc_CVE-2026-63858",
      "initial_release_date": "2026-07-20T01:04:00.000Z",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "netfilter: nf_tables: add hook transactions for device deletions",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-63858.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/net/netfilter/nf_tables.h",
                  "net/netfilter/nf_tables_api.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "4e69bfb32b2db323d9205fdb30e284481b37817c",
                    "status": "affected",
                    "version": "b6d9014a3335194590abdd2a2471ef5147a67645",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "10f79dbd7719d1da9f5884d13060322d8729f091",
                    "status": "affected",
                    "version": "b6d9014a3335194590abdd2a2471ef5147a67645",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "7a248f9c74f9f62799718c12efd9e9e391d60b6f",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "f275989ad04159dbfc62cefb65ba9c5ba1d7c34f",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "62d91062058b42bf70b2c3446aec397bb0ce15ee",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "99180dec5ae582227219d1fdd0dd5ccf53ec7491",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.11",
                    "status": "affected",
                    "version": "5.10.122",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.16",
                    "status": "affected",
                    "version": "5.15.47",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.18",
                    "status": "affected",
                    "version": "5.17.15",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.19",
                    "status": "affected",
                    "version": "5.18.4",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/net/netfilter/nf_tables.h",
                  "net/netfilter/nf_tables_api.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.19"
                  },
                  {
                    "lessThan": "5.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: add hook transactions for device deletions\n\nRestore the flag that indicates that the hook is going away, ie.\nNFT_HOOK_REMOVE, but add a new transaction object to track deletion\nof hooks without altering the basechain/flowtable hook_list during\nthe preparation phase.\n\nThe existing approach that moves the hook from the basechain/flowtable\nhook_list to transaction hook_list breaks netlink dump path readers\nof this RCU-protected list.\n\nIt should be possible use an array for nft_trans_hook to store the\ndeleted hooks to compact the representation but I am not expecting\nmany hook object, specially now that wildcard support for devices\nis in place.\n\nNote that the nft_trans_chain_hooks() list contains a list of struct\nnft_trans_hook objects for DELCHAIN and DELFLOWTABLE commands, while\nthis list stores struct nft_hook objects for NEWCHAIN and NEWFLOWTABLE.\nNote that new commands can be updated to use nft_trans_hook for\nconsistency.\n\nThis patch also adapts the event notification path to deal with the list\nof hook transactions."
          }
        ],
        "id": "CVE-2026-63858",
        "lastModified": "2026-07-27T17:44:23.777",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T15:16:52.643",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/10f79dbd7719d1da9f5884d13060322d8729f091"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4e69bfb32b2db323d9205fdb30e284481b37817c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-21T19:03:59+00:00",
      "cve": "CVE-2026-63858",
      "id": "CVE-2026-63858",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: nf_tables: add hook transactions for device deletions",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63858.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-18T16:57:21Z",
      "cve": "CVE-2026-63858",
      "id": "CVE-2026-63858",
      "initial_release_date": "2026-07-24T02:13:29Z",
      "product_status:known_affected": "30",
      "product_status:known_not_affected": "251",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63858",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63858.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.