CVE-2026-64076 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bridge: eb_tables: close module init race
sashiko reports for unrelated patch: Does the core ebtables initialization in ebtables.c suffer from a similar race? Once nf_register_sockopt() completes, the sockopts are exposed globally.
sockopt has to be registered last, just like in ip/ip6/arptables.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability described represents a race condition in the Linux kernel's netfilter framework, specifically within the bridge netfilter subsystem where ebtables operates. This issue occurs during module initialization when there exists a temporal window between when the core ebtables initialization completes and when socket options are registered through nf_register_sockopt(). The race condition arises because once sockopts are exposed globally, they can potentially be accessed before all necessary initialization is complete, creating a potential attack surface for malicious actors who might exploit this timing gap to manipulate kernel state.
The technical flaw stems from the improper ordering of module initialization steps within the ebtables subsystem. In the bridge netfilter context, the ebtables.c core initialization process does not properly synchronize with the socket option registration phase that occurs later. This creates a window where socket options become accessible to user-space processes before the underlying ebtables data structures are fully initialized and validated. The issue is particularly concerning because it affects the fundamental integrity of the network filtering subsystem, potentially allowing privilege escalation or denial of service conditions when malicious code attempts to interact with these improperly synchronized components.
The operational impact of this vulnerability extends beyond simple race condition exploitation, as it undermines the security guarantees provided by the netfilter framework's bridge functionality. Attackers could potentially leverage this timing gap to inject malformed socket options that might trigger kernel memory corruption or bypass access controls. The vulnerability affects systems using bridge netfilter functionality where ebtables rules are applied to bridged network traffic, which is common in virtualized environments and containerized deployments. This creates a significant risk for cloud infrastructure providers and enterprise networks that rely on proper network isolation between virtual machines or containers.
Security mitigations for this vulnerability should focus on ensuring proper initialization sequencing within the ebtables subsystem, particularly by enforcing that socket option registration occurs only after all core components are fully initialized and validated. The fix typically involves modifying the module initialization order to prevent nf_register_sockopt() from completing until all prerequisite data structures are properly established. This approach aligns with standard security practices outlined in the CWE taxonomy under CWE-362, which addresses race conditions in concurrent systems. Additionally, implementing proper locking mechanisms during initialization phases can provide further protection against similar timing issues. Organizations should prioritize updating their kernel versions to include the patched implementation that resolves this specific race condition, as recommended by the Linux kernel security team and documented through standard vulnerability disclosure processes.
The vulnerability demonstrates the importance of careful module initialization ordering in kernel space, particularly within complex subsystems like netfilter where multiple components must be synchronized. This type of race condition commonly appears in systems following the ATT&CK framework's T1068 technique for local privilege escalation through kernel vulnerabilities. The fix reinforces principles from the principle of least privilege and defense in depth by ensuring that system components are fully operational before exposing them to potential external access, thereby preventing attackers from exploiting temporal inconsistencies in kernel initialization sequences.