Linux Kernel up to 7.1.3/7.2-rc2 Netfilter Flowtable nf_flow_offload_add Remote Code Execution

Summaryinfo

A vulnerability labeled as critical has been found in Linux Kernel up to 7.1.3/7.2-rc2. Affected by this vulnerability is the function nf_flow_offload_add of the component Netfilter Flowtable. Executing a manipulation can lead to Remote Code Execution. This vulnerability appears as CVE-2026-64410. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.1.3/7.2-rc2. It has been declared as critical. This vulnerability affects the function nf_flow_offload_add of the component Netfilter Flowtable. The manipulation with an unknown input leads to a remote code execution vulnerability. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: IPIP tunnel hardware offload is not yet support No driver supports for IPIP tunnels yet, give up early on setting up the hardware offload for this scenario. This patch adds a stub that can be enhanced to add more configuration that are currently not supported. As of now, the offload work is enqueued to the worker, then ignored if the hardware offload configuration is not supported. Check the NF_FLOW_HW flag to know if this entry was already tried once to be offloaded so this is not retried on refresh when unsupported. Move NF_FLOW_HW flag check to nf_flow_offload_add(). If this NF_FLOW_HW flag is unset the _del and _stats variants are never called. This can be updated later on to skip hardware offload work to be queued in case hardware offload does not support it.

The advisory is available at git.kernel.org. This vulnerability was named CVE-2026-64410 since 07/19/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 07/25/2026).

Upgrading to version 7.1.4 or 7.2-rc3 eliminates this vulnerability. Applying the patch 9efe838c13133acb70c78d04c49e8362fe533566/6c5dcab95f4cd42a1648739ec9300fbb4b1a021f is able to eliminate this problem.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.2-rc1
• 7.2-rc2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion