CVE-2026-64150

CVE-2026-64150

Critical · published July 19, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
50.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_inner: release local_lock before re-enabling softirqs

Quoting sashiko:

In the error path, local_bh_enable() is called before

local_unlock_nested_bh().

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00649 · 50.5th percentile
Published
2026-07-19T20:17Z
Affected products (6)
ProductVersionsFixed in
linux/linux_kernel≥ 6.16, < 6.18.346.18.34
linux/linux_kernel≥ 6.19, < 7.0.117.0.11
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (3)
https://git.kernel.org/stable/c/6fecd39c6401134b58505bc4eb1adc8a0e2fe992 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a6cb3ff979855f7f0ee9450a947fe8f96c2ba37a · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/df19b6af171695a1352314597c9a4311d48d5171 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 19 JUL 15:40Z
    netfilter: nft_inner: release local_lock before re-enabling softirqs
    cvelistv5