{"id":"CVE-2026-63858","revision":"6e2ce0fe99b7405688737ad4bb1270f7","records":[{"revision":"6e2ce0fe99b7405688737ad4bb1270f7","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-63858","aliases":[],"title":"netfilter: nf_tables: add hook transactions for device deletions","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: add hook transactions for device deletions\n\nRestore the flag that indicates that the hook is going away, ie.\nNFT_HOOK_REMOVE, but add a new transaction object to track deletion\nof hooks without altering the basechain/flowtable hook_list during\nthe preparation phase.\n\nThe existing approach that moves the hook from the basechain/flowtable\nhook_list to transaction hook_list breaks netlink dump path readers\nof this RCU-protected list.\n\nIt should be possible use an array for nft_trans_hook to store the\ndeleted hooks to compact the representation but I am not expecting\nmany hook object, specially now that wildcard support for devices\nis in place.\n\nNote that the nft_trans_chain_hooks() list contains a list of struct\nnft_trans_hook objects for DELCHAIN and DELFLOWTABLE commands, while\nthis list stores struct nft_hook objects for NEWCHAIN and NEWFLOWTABLE.\nNote that new commands can be updated to use nft_trans_hook for\nconsistency.\n\nThis patch also adapts the event notification path to deal with the list\nof hook transactions.","state":0,"publishedAt":"2026-07-19T14:04:46.967+00:00","modifiedAt":"2026-10-19T20:07:52.23+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/net/netfilter/nf_tables.h\",\n                        \"net/netfilter/nf_tables_api.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"b6d9014a3335194590abdd2a2471ef5147a67645\",\n                            \"lessThan\": \"768daa9f4276be4007e88dea61a378c8582ba008\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b6d9014a3335194590abdd2a2471ef5147a67645\",\n                            \"lessThan\": \"4e69bfb32b2db323d9205fdb30e284481b37817c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b6d9014a3335194590abdd2a2471ef5147a67645\",\n                            \"lessThan\": \"10f79dbd7719d1da9f5884d13060322d8729f091\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7a248f9c74f9f62799718c12efd9e9e391d60b6f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f275989ad04159dbfc62cefb65ba9c5ba1d7c34f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"62d91062058b42bf70b2c3446aec397bb0ce15ee\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"99180dec5ae582227219d1fdd0dd5ccf53ec7491\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.10.122\",\n                            \"lessThan\": \"5.11\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.47\",\n                            \"lessThan\": \"5.16\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.17.15\",\n                            \"lessThan\": \"5.18\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.18.4\",\n                            \"lessThan\": \"5.19\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/net/netfilter/nf_tables.h\",\n                        \"net/netfilter/nf_tables_api.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.19\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.19\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.57\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.10\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/768daa9f4276be4007e88dea61a378c8582ba008","https://git.kernel.org/stable/c/4e69bfb32b2db323d9205fdb30e284481b37817c","https://git.kernel.org/stable/c/10f79dbd7719d1da9f5884d13060322d8729f091"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63858","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-63858","identifiers":["CVE-2026-63858"]},"retained":false,"historicalAffected":[]}],"coverage":[]}