CVE-2026-64150 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_inner: release local_lock before re-enabling softirqs
Quoting sashiko: In the error path, local_bh_enable() is called before local_unlock_nested_bh().
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability identified in the Linux kernel's netfilter subsystem represents a critical race condition involving interrupt handling and lock management within the nft_inner module. This flaw manifests when processing network packets through the netfilter framework, specifically during error paths where the system attempts to restore interrupt state before properly releasing acquired locks. The improper ordering of operations creates a potential security risk that could be exploited by malicious actors to disrupt system stability or potentially escalate privileges.
The technical root cause stems from the incorrect sequence of function calls within the error handling pathway of the nft_inner implementation. When an error occurs during packet processing, the system executes local_bh_enable() before local_unlock_nested_bh(), which violates fundamental lock ordering principles and can lead to undefined behavior in concurrent execution contexts. This violates the established principle that locks should be released before restoring interrupt state, as documented in various kernel development best practices and security guidelines.
This vulnerability impacts systems heavily reliant on netfilter for packet filtering, NAT operations, and firewall functionality, particularly those running high-throughput network applications or serving as network infrastructure devices. The operational consequences include potential system crashes, denial of service conditions, and unpredictable behavior in network processing pipelines. Attackers could exploit this weakness to cause system instability or potentially leverage the race condition to bypass security controls within the netfilter framework.
The flaw aligns with CWE-121, which addresses stack-based buffer overflow conditions, and relates to ATT&CK technique T1059, specifically focusing on command and scripting interpreter usage in compromised systems. While not directly a privilege escalation vulnerability, it creates opportunities for attackers to destabilize network services and potentially create conditions favorable for more serious attacks.
Mitigation strategies include applying the latest kernel security patches from the Linux kernel maintainers, which properly reorder the lock release and interrupt enable operations to ensure correct execution flow. System administrators should also implement comprehensive monitoring of netfilter-related system calls and packet processing errors to detect potential exploitation attempts. Additionally, deploying network segmentation and intrusion detection systems can help identify abnormal network behavior patterns that may indicate exploitation of this vulnerability in the wild.