---
id: CVE-2026-63858
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nf_tables: add hook transactions for device deletions

  Restore the flag that indicates that the hook is going away, ie.
  NFT_HOOK_REMOVE, but add a new transa…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nf_tables: add hook transactions for device deletions

  Restore the flag that indicates that the hook is going away, ie.
  NFT_HOOK_REMOVE, but add a new transa…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b6d9014a3335194590abdd2a2471ef5147a67645 <
    768daa9f4276be4007e88dea61a378c8582ba008
  - >-
    Linux >= b6d9014a3335194590abdd2a2471ef5147a67645 <
    4e69bfb32b2db323d9205fdb30e284481b37817c
  - >-
    Linux >= b6d9014a3335194590abdd2a2471ef5147a67645 <
    10f79dbd7719d1da9f5884d13060322d8729f091
  - Linux 7a248f9c74f9f62799718c12efd9e9e391d60b6f
  - Linux f275989ad04159dbfc62cefb65ba9c5ba1d7c34f
  - Linux 62d91062058b42bf70b2c3446aec397bb0ce15ee
  - Linux 99180dec5ae582227219d1fdd0dd5ccf53ec7491
  - Linux >= 5.10.122 < 5.11
  - Linux >= 5.15.47 < 5.16
  - Linux >= 5.17.15 < 5.18
  - Linux >= 5.18.4 < 5.19
  - Linux 5.19
published: '2026-07-19'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:37.640'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63858'
references:
  - url: 'https://git.kernel.org/stable/c/10f79dbd7719d1da9f5884d13060322d8729f091'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4e69bfb32b2db323d9205fdb30e284481b37817c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/768daa9f4276be4007e88dea61a378c8582ba008'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00118
epssPercentile: 0.01615
ingestedAt: '2026-10-15T11:00:41.698Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: add hook transactions for device deletions

Restore the flag that indicates that the hook is going away, ie.
NFT_HOOK_REMOVE, but add a new transaction object to track deletion
of hooks without altering the basechain/flowtable hook_list during
the preparation phase.

The existing approach that moves the hook from the basechain/flowtable
hook_list to transaction hook_list breaks netlink dump path readers
of this RCU-protected list.

It should be possible use an array for nft_trans_hook to store the
deleted hooks to compact the representation but I am not expecting
many hook object, specially now that wildcard support for devices
is in place.

Note that the nft_trans_chain_hooks() list contains a list of struct
nft_trans_hook objects for DELCHAIN and DELFLOWTABLE commands, while
this list stores struct nft_hook objects for NEWCHAIN and NEWFLOWTABLE.
Note that new commands can be updated to use nft_trans_hook for
consistency.

This patch also adapts the event notification path to deal with the list
of hook transactions.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.