CVE-2026-64079

In the Linux kernel, the following vulnerability has been resolved:

netfilter: x_tables: allocate hook ops while under mutex

arp/ip(6)t_register_table() add the table to the per-netns list via

xt_register_table() before allocating the per-netns hook ops copy

via kmemdup_array(). This leaves a window where the table is

visible in the list with ops=NULL.

If the pernet exit happens runs concurrently the pre_exit callback finds

the table via xt_find_table() and passes the NULL ops pointer to

nf_unregister_net_hooks(), causing a NULL dereference:

general protection fault in nf_unregister_net_hooks+0xbc/0x150

RIP: nf_unregister_net_hooks (net/netfilter/core.c:613)

Call Trace:

ipt_unregister_table_pre_exit

iptable_mangle_net_pre_exit

ops_pre_exit_list

cleanup_net

Fix by moving the ops allocation into the xtables core so the table is

never in the list without valid ops. Also ensure the table is no longer

processing packets before its torn down on error unwind.

nf_register_net_hooks might have published at least one hook; call

synchronize_rcu() if there was an error.

audit log register message gets deferred until all operations have

passed, this avoids need to emit another ureg message in case of

error unwinding.

Based on earlier patch by Tristan Madani.