Description
In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: fix race between dump and ip_set_list resize

The release path of ip_set_dump_do() and ip_set_dump_done() read
inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw()
of the array pointer. These run from netlink_recvmsg() without the nfnl
mutex and without an RCU read-side critical section.

A concurrent ip_set_create() can grow the array: it publishes the new
array, calls synchronize_net() and then kvfree()s the old one. Since the
dump paths read the array outside any RCU reader, synchronize_net() does
not wait for them and the old array can be freed while they still index
into it, causing a use-after-free.

The dumped set itself stays pinned via set->ref_netlink, so only the
array load needs protecting. Take rcu_read_lock() around it, matching
ip_set_get_byname() and __ip_set_put_byindex().

BUG: KASAN: slab-use-after-free in ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697)
Read of size 8 at addr ffff88800b5c4018 by task exploit/150
Call Trace:
...
kasan_report (mm/kasan/report.c:595)
ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697)
netlink_dump (net/netlink/af_netlink.c:2325)
netlink_recvmsg (net/netlink/af_netlink.c:1976)
sock_recvmsg (net/socket.c:1159)
__sys_recvfrom (net/socket.c:2315)
...
Oops: general protection fault, probably for non-canonical address ... KASAN NOPTI
KASAN: maybe wild-memory-access in range [0x02d6...d0-0x02d6...d7]
RIP: 0010:ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1698)
Kernel panic - not syncing: Fatal exception
Published: 2026-07-20
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A race condition between the ipset dump routines and ip_set_create() causes a use‑after‑free in the Linux kernel. During an ipset dump the code dereferences the ip_set_list array without RCU protection while a concurrent create publishes a new array and frees the old one. The stale pointer can then be read, provoking a KASAN error and a kernel panic. The denial of service is limited to a kernel crash stemming from this use‑after‑free. This weakness is a classic use‑after‑free, classified as CWE‑825.

Affected Systems

All Linux kernel releases that contain the ipset dump code before the applied fix are affected. The patch resides in the Linux kernel repository and applies to any kernel built from the open source tree, irrespective of distribution; affected versions are those that have not yet incorporated the commit that introduced RCU protection around the array load.

Risk and Exploitability

EPSS score is <1% and the CVSS score of 7.8 indicates a medium‑to‑high impact. It appears that precise timing may be required to trigger the race condition between the ipset dump routines and a concurrent array resize. The vulnerability is not listed in CISA KEV. Due to the concurrency requirement, exploitation is likely to be challenging but remains a legitimate risk.

Generated by OpenCVE AI on August 4, 2026 at 06:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a Linux kernel update that contains the ipset dump fix (commit discussed in the listed git references).
  • If an immediate kernel upgrade is not possible, restrict access to the ipset netlink interface—remove or disable the ipset module or block the associated netlink groups for non‑trusted users.
  • Enforce the principle of least privilege: ensure that only trusted, hardened processes can issue ipset commands, and consider using a firewall to filter netlink traffic from untrusted hosts.

Generated by OpenCVE AI on August 4, 2026 at 06:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4717-1 linux security update
Debian DLA Debian DLA DLA-4720-1 linux security update
Debian DLA Debian DLA DLA-4723-1 linux-6.1 security update
Debian DLA Debian DLA DLA-4724-1 linux-6.12 new package
Debian DSA Debian DSA DSA-6393-1 linux security update
History

Mon, 27 Jul 2026 05:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
References

Tue, 21 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Mon, 20 Jul 2026 16:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_list resize The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw() of the array pointer. These run from netlink_recvmsg() without the nfnl mutex and without an RCU read-side critical section. A concurrent ip_set_create() can grow the array: it publishes the new array, calls synchronize_net() and then kvfree()s the old one. Since the dump paths read the array outside any RCU reader, synchronize_net() does not wait for them and the old array can be freed while they still index into it, causing a use-after-free. The dumped set itself stays pinned via set->ref_netlink, so only the array load needs protecting. Take rcu_read_lock() around it, matching ip_set_get_byname() and __ip_set_put_byindex(). BUG: KASAN: slab-use-after-free in ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697) Read of size 8 at addr ffff88800b5c4018 by task exploit/150 Call Trace: ... kasan_report (mm/kasan/report.c:595) ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697) netlink_dump (net/netlink/af_netlink.c:2325) netlink_recvmsg (net/netlink/af_netlink.c:1976) sock_recvmsg (net/socket.c:1159) __sys_recvfrom (net/socket.c:2315) ... Oops: general protection fault, probably for non-canonical address ... KASAN NOPTI KASAN: maybe wild-memory-access in range [0x02d6...d0-0x02d6...d7] RIP: 0010:ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1698) Kernel panic - not syncing: Fatal exception
Title netfilter: ipset: fix race between dump and ip_set_list resize
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-05T12:39:58.779Z

Reserved: 2026-07-19T07:54:57.040Z

Link: CVE-2026-64189

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-20T00:00:00Z

Links: CVE-2026-64189 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T06:15:04Z

Weaknesses
  • CWE-825

    Expired Pointer Dereference