---
id: CVE-2026-64078
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: x_tables: add and use xtables_unregister_table_exit

  Previous change added xtables_unregister_table_pre_exit to detach the
  table from the packetpath and to u…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: x_tables: add and use xtables_unregister_table_exit

  Previous change added xtables_unregister_table_pre_exit to detach the
  table from the packetpath and to u…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.15, < 6.18.34'
  - 'linux_kernel >= 6.19, < 7.0.11'
  - linux_kernel = 7.1
patched:
  - linux_kernel 7.0.11
published: '2026-07-19'
updated: '2026-09-03'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64078'
references:
  - url: 'https://git.kernel.org/stable/c/8026e5163cca1d1db436c7bfb89ddea8b5e8c2cf'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/86ee5bc9c0f0e652e19f395675a432de11b75514'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b4597d5fd7d2f8cebfffd40dffb5e003cc78964c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64078.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-64078'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2502554'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-64078'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64078'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026071914-CVE-2026-64078-ff87@gregkh/T
  - url: 'https://access.redhat.com/errata/RHSA-2026:76738'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00127
epssPercentile: 0.02376
ingestedAt: '2026-09-04T05:15:22.879Z'
cwe:
  - CWE-459
scores:
  nvd: 7.8
  vendor: 7.1
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: x_tables: add and use xtables_unregister_table_exit

Previous change added xtables_unregister_table_pre_exit to detach the
table from the packetpath and to unlink it from the active table list.
In case of rmmod, userspace that is doing set/getsockopt for this table
will not be able to re-instantiate the table:
 1. The larval table has been removed already
 2. existing instantiated table is no longer on the xt pernet table list.

This adds the second stage helper:

unlink the table from the dying list, free the hook ops (if any) and do
the audit notification.  It replaces xt_unregister_table().

## Affected

- `linux_kernel >= 5.15, < 6.18.34`
- `linux_kernel >= 6.19, < 7.0.11`
- `linux_kernel = 7.1`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.0.11`

## Vendor advisories

- **RHSA-2026:76738** · Red Hat · fixed in: 10Base-SMTV, Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Hidden (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), … · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:76738)