CVE-2026-64189 in Linux
Summary
by MITRE • 07/20/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: fix race between dump and ip_set_list resize
The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw() of the array pointer. These run from netlink_recvmsg() without the nfnl mutex and without an RCU read-side critical section.
A concurrent ip_set_create() can grow the array: it publishes the new array, calls synchronize_net() and then kvfree()s the old one. Since the dump paths read the array outside any RCU reader, synchronize_net() does not wait for them and the old array can be freed while they still index into it, causing a use-after-free.
The dumped set itself stays pinned via set->ref_netlink, so only the array load needs protecting. Take rcu_read_lock() around it, matching ip_set_get_byname() and __ip_set_put_byindex().
BUG: KASAN: slab-use-after-free in ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697) Read of size 8 at addr ffff88800b5c4018 by task exploit/150 Call Trace: ... kasan_report (mm/kasan/report.c:595) ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697) netlink_dump (net/netlink/af_netlink.c:2325) netlink_recvmsg (net/netlink/af_netlink.c:1976) sock_recvmsg (net/socket.c:1159) __sys_recvfrom (net/socket.c:2315) ... Oops: general protection fault, probably for non-canonical address ... KASAN NOPTI KASAN: maybe wild-memory-access in range [0x02d6...d0-0x02d6...d7]
RIP: 0010:ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1698) Kernel panic - not syncing: Fatal exception
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability described represents a critical race condition in the Linux kernel's netfilter subsystem, specifically within the ipset module that manages network packet filtering rules. This flaw occurs when concurrent operations attempt to access shared data structures without proper synchronization mechanisms. The issue stems from improper handling of RCU (Read-Copy-Update) operations during the dumping process of ipset configurations, creating a scenario where memory can be freed while still being accessed by ongoing dump operations.
The technical root cause involves the improper use of rcu_dereference_raw() within the ip_set_dump_do() and ip_set_dump_done() functions which are executed from netlink_recvmsg() without appropriate RCU read-side critical sections. When a concurrent ip_set_create() operation occurs, it can expand the internal array structure used by ipset. The new array is published first, followed by synchronize_net() which waits for network processing but does not wait for ongoing dump operations that are reading from the old array. This creates a window where the old array memory gets freed via kvfree() while the dump functions are still indexing into it, leading to use-after-free conditions.
The operational impact of this vulnerability is severe as it can lead to kernel crashes and potential privilege escalation opportunities. The KASAN (Kernel Address Sanitizer) reports show a clear slab-use-after-free error occurring at ip_set_dump_do() where memory is accessed after being freed, with the crash traceback indicating the fault occurs during network packet processing. This vulnerability affects systems running Linux kernels that implement netfilter and ipset functionality, particularly those handling concurrent network filtering operations.
Mitigation strategies should focus on implementing proper RCU read-side locking around array access points in the dump functions to match the protection patterns used elsewhere in the codebase such as in ip_set_get_byname() and __ip_set_put_byindex(). The fix involves adding rcu_read_lock() calls before accessing the inst->ip_set_list array, ensuring that any ongoing RCU updates are properly synchronized with read operations. This approach aligns with established security practices for concurrent data structure access and follows the ATT&CK framework's mitigation recommendations for kernel-level race condition vulnerabilities. The solution directly addresses the CWE-362 weakness category related to concurrent execution using shared resources without proper synchronization, ensuring that memory safety is maintained during inter-process communication operations in network filtering subsystems.