Race Condition in Netfilter's IPSet Functionality in Linux Kernel

CVE-2026-64189

What is CVE-2026-64189?

A race condition vulnerability identified in the Linux kernel's netfilter ipset can lead to a use-after-free error during array access. The issue occurs when the ip_set_dump_do() and ip_set_dump_done() functions attempt to read an array pointer outside of a necessary read-side critical section. This happens without holding the appropriate mutex, which can allow a concurrent ip_set_create() operation to grow the array and free the old one while still being accessed by the dump paths. If exploited, this can lead to crashes or unpredictable behavior within the system.

References