In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: allocate hook ops while under mutex arp/ip(6)t_register_table() add the table to the per-netns list via xt_register_table() before allocating the per-netns hook ops copy via kmemdup_array(). This leaves a window where the table is visible in the list with ops=NULL. If the pernet exit happens runs concurrently the pre_exit callback finds the table via xt_find_table() and passes the NULL ops pointer to nf_unregister_net_hooks(), causing a NULL dereference: general protection fault in nf_unregister_net_hooks+0xbc/0x150 RIP: nf_unregister_net_hooks (net/netfilter/core.c:613) Call Trace: ipt_unregister_table_pre_exit iptable_mangle_net_pre_exit ops_pre_exit_list cleanup_net Fix by moving the ops allocation into the xtables core so the table is never in the list without valid ops. Also ensure the table is no longer processing packets before its torn down on error unwind. nf_register_net_hooks might have published at least one hook; call synchronize_rcu() if there was an error. audit log register message gets deferred until all operations have passed, this avoids need to emit another ureg message in case of error unwinding. Based on earlier patch by Tristan Madani.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: allocate hook ops
    while under mutex arp/ip(6)t_register_table() add the table to the per-netns list via xt_register_table()
    before allocating the per-netns hook ops copy via kmemdup_array(). This leaves a window where the table is
    visible in the list with ops=NULL. If the pernet exit happens runs concurrently the pre_exit callback
    finds the table via xt_find_table() and passes the NULL ops pointer to nf_unregister_net_hooks(), causing
    a NULL dereference: general protection fault in nf_unregister_net_hooks+0xbc/0x150 RIP:
    nf_unregister_net_hooks (net/netfilter/core.c:613) Call Trace: ipt_unregister_table_pre_exit
    iptable_mangle_net_pre_exit ops_pre_exit_list cleanup_net Fix by moving the ops allocation into the
    xtables core so the table is never in the list without valid ops. Also ensure the table is no longer
    processing packets before its torn down on error unwind. nf_register_net_hooks might have published at
    least one hook; call synchronize_rcu() if there was an error. audit log register message gets deferred
    until all operations have passed, this avoids need to emit another ureg message in case of error
    unwinding. Based on earlier patch by Tristan Madani. (CVE-2026-64079)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - netfilter: x_tables: allocate hook ops while under mutex arp/ip(6)t_register_table() add the table to the     per-netns list via xt_register_table() before allocating the per-netns hook ops copy via kmemdup_array().
    This leaves a window where the table is visible in the list with ops=NULL. If the pernet exit happens runs     concurrently the pre_exit callback finds the table via xt_find_table() and passes the NULL ops pointer to     nf_unregister_net_hooks(), causing a NULL dereference: general protection fault in     nf_unregister_net_hooks+0xbc/0x150 RIP: nf_unregister_net_hooks (net/netfilter/core.c:613) Call Trace:
    ipt_unregister_table_pre_exit iptable_mangle_net_pre_exit ops_pre_exit_list cleanup_net Fix by moving the     ops allocation into the xtables core so the table is never in the list without valid ops. Also ensure the     table is no longer processing packets before its torn down on error unwind. nf_register_net_hooks might     have published at least one hook; call synchronize_rcu() if there was an error. audit log register message     gets deferred until all operations have passed, this avoids need to emit another ureg message in case of     error unwinding. Based on earlier patch by Tristan Madani. (CVE-2026-64079)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365279	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3196)	Nessus	Amazon Linux Local Security Checks	Local	medium
365220	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-3197)	Nessus	Amazon Linux Local Security Checks	Local	medium
472557	Chainguard: linux-qemu-melange: security update to 6.18.49-r2	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
472557	Chainguard: linux-qemu-melange: security update to 6.18.49-r2	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	Local	high
340681	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
327941	Linux Distros Unpatched Vulnerability : CVE-2026-64079	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-64079

medium

Tenable Plugins

medium

medium

medium

medium

high

high

high

medium