CVE-2026-63858 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: add hook transactions for device deletions
Restore the flag that indicates that the hook is going away, ie. NFT_HOOK_REMOVE, but add a new transaction object to track deletion of hooks without altering the basechain/flowtable hook_list during the preparation phase.
The existing approach that moves the hook from the basechain/flowtable hook_list to transaction hook_list breaks netlink dump path readers of this RCU-protected list.
It should be possible use an array for nft_trans_hook to store the deleted hooks to compact the representation but I am not expecting many hook object, specially now that wildcard support for devices is in place.
Note that the nft_trans_chain_hooks() list contains a list of struct nft_trans_hook objects for DELCHAIN and DELFLOWTABLE commands, while this list stores struct nft_hook objects for NEWCHAIN and NEWFLOWTABLE. Note that new commands can be updated to use nft_trans_hook for consistency.
This patch also adapts the event notification path to deal with the list of hook transactions.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability addressed in this linux kernel netfilter module relates to improper handling of network hook transactions during device deletion operations within the nf_tables subsystem. This issue specifically impacts the management of hook objects associated with basechains and flowtables, creating potential inconsistencies in the RCU-protected data structures that are critical for concurrent network packet processing. The flaw stems from an incorrect approach where hooks were being moved from their original locations in the basechain or flowtable hook_list to a transaction-specific hook_list during the preparation phase, which fundamentally breaks the netlink dump path readers that depend on these RCU-protected lists for consistent data access.
The technical implementation defect involves the removal of a crucial flag NFT_HOOK_REMOVE that previously indicated when a hook was in the process of being removed from the system. This flag is essential for proper state tracking and notification mechanisms throughout the network filtering subsystem. The patch resolves this by reintroducing the flag while implementing a new transaction object approach to track hook deletions without modifying the core basechain or flowtable hook_list during the preparation phase. This maintains data integrity in the RCU-protected structures while allowing proper transaction handling for device deletion scenarios.
The operational impact of this vulnerability extends beyond simple data corruption, as it affects the reliability of network filtering operations and could potentially lead to inconsistent firewall rules or packet processing behavior. The breakage in netlink dump path readers represents a serious issue since these interfaces are used by various monitoring and management tools that depend on consistent access to the network hook state information. This could result in misconfigured firewalls, failed network policy enforcement, or complete loss of visibility into active network filtering rules during dynamic configuration changes.
The mitigation approach implemented in this patch establishes a more robust transaction handling mechanism by introducing separate tracking for hook deletion operations while preserving the integrity of core data structures. The solution maintains backward compatibility with existing systems while addressing the fundamental issue of RCU list corruption during concurrent access scenarios. The suggested implementation using an array for nft_trans_hook to store deleted hooks provides a compact representation that should handle typical workloads effectively, though the patch notes that hook object counts are expected to remain relatively low due to recent wildcard device support improvements. This approach aligns with common security practices for maintaining data consistency in concurrent systems and follows established patterns for transaction management in kernel networking components.
The fix also includes necessary adaptations to the event notification path to properly handle the new list of hook transactions, ensuring that external systems relying on network filtering events receive accurate information about hook state changes. This comprehensive approach addresses both the immediate technical flaw in hook deletion handling and the broader integration requirements for proper system notifications. The solution demonstrates adherence to kernel security principles by maintaining atomicity in data structure modifications while preserving system stability during concurrent access patterns. This vulnerability resolution follows established security practices for managing complex transactional operations in kernel space, particularly relevant to the CWE-129 weakness category related to improper handling of buffer sizes and access control mechanisms in kernel modules.
The patch represents a targeted fix that specifically addresses the race conditions and data integrity issues present in the nf_tables subsystem's hook management. It maintains consistency with the overall architecture by using existing transaction patterns while introducing minimal overhead through the array-based storage approach for deleted hooks. The implementation ensures that the network filtering subsystem continues to operate reliably under concurrent access conditions, preventing potential security implications that could arise from inconsistent firewall rule states or packet processing behavior during dynamic configuration changes. This vulnerability resolution exemplifies proper kernel security engineering practices by addressing root cause issues rather than surface symptoms, maintaining the fundamental integrity of the netfilter framework while supporting modern network management requirements.