CVE-2026-63858 is a newly published Linux kernel flaw in Netfilter’s
The National Vulnerability Database published the record on July 19, 2026, with no CVSS score or NVD severity assessment yet assigned. The underlying fix was authored by Netfilter maintainer Pablo Neira Ayuso and appeared on the Netdev mailing list in April; it addresses a transaction-handling problem introduced in code supporting device deletion from existing netdev chains and flowtable hook transactions.
This is a kernel correctness and concurrency fix first, not evidence of a confirmed remotely exploitable bug. Still, the fact that it received a CVE means administrators should treat it as a security-relevant kernel update rather than merely an nftables regression note.
Linux Netfilter uses hooks to place packet-filtering and flowtable logic at defined points in the network stack. In nftables, a base chain or flowtable can be attached to a network device, including for
According to the kernel patch description, the prior implementation physically moved a hook from the base chain or flowtable’s
In practical terms, the old logic changed a structure that other readers still expected to remain stable. A management tool enumerating nftables state through netlink could encounter inconsistent hook-list contents while another operation was removing a device hook. The patch restores the
That distinction matters. The kernel can now mark a hook as on its way out, preserve the active list through the transaction’s preparation, then finalize the removal through the proper transaction and event-notification paths.
The record also links two stable-kernel commits for the fix. That typically means maintainers have backported the correction into selected supported branches, rather than relying solely on the eventual upstream release. Distribution vendors may therefore ship the repair under a kernel package version that does not visibly match the mainline version cited in the CVE record.
Administrators should check the exact kernel package and vendor advisory, not simply compare
The relevant source files are
A firewall configuration can therefore be correct in static tests while still triggering the faulty path during routine operational churn: a virtual interface disappearing, a bridge member being removed, a container network being torn down, or an automation system reconciling nftables rules while state is being queried.
The direct consequence described by the patch is an inconsistency in access to an RCU-protected list. The public CVE entry does not currently assign a weakness category, a CVSS vector, or an exploit scenario. It does not state that arbitrary code execution, privilege escalation, information disclosure, or a denial of service has been demonstrated.
That uncertainty should shape the response. It would be premature to describe CVE-2026-63858 as a critical remotely reachable nftables vulnerability. It would be equally mistaken to ignore it: kernel concurrency defects in packet filtering are exactly the kind of issue that can become disruptive under real-world network automation, and later security analysis can alter the severity picture.
But Windows-centric estates often operate Linux in places that are easy to overlook:
Before patching, establish whether the system uses the affected functionality.
After the update, validate both the kernel version and the operational path. A successful package installation is not enough if the host continues to boot an older kernel. Confirm the running release with
The NVD entry is only a day old as of July 20, and its missing severity assessment is the key unresolved point. For now, CVE-2026-63858 belongs in the next routine kernel-maintenance window for most environments—and nearer the front of the queue for nftables-heavy Linux infrastructure whose interfaces and firewall state are constantly in motion.
nf_tables subsystem that can break readers of firewall hook state while network-device hooks are being deleted. For Windows administrators, the immediate exposure is not Windows itself but Linux systems running alongside it: WSL 2 distributions, Hyper-V-hosted Linux appliances, Azure workloads, edge gateways, Kubernetes nodes, and firewall VMs using nftables.The National Vulnerability Database published the record on July 19, 2026, with no CVSS score or NVD severity assessment yet assigned. The underlying fix was authored by Netfilter maintainer Pablo Neira Ayuso and appeared on the Netdev mailing list in April; it addresses a transaction-handling problem introduced in code supporting device deletion from existing netdev chains and flowtable hook transactions.
This is a kernel correctness and concurrency fix first, not evidence of a confirmed remotely exploitable bug. Still, the fact that it received a CVE means administrators should treat it as a security-relevant kernel update rather than merely an nftables regression note.
The Bug Is in How nftables Removes Device Hooks
Linux Netfilter uses hooks to place packet-filtering and flowtable logic at defined points in the network stack. In nftables, a base chain or flowtable can be attached to a network device, including for netdev ingress filtering. When an administrator deletes or changes a device association, the kernel must unregister the relevant hook while maintaining coherent state for packet processing, netlink management operations, and notification code.According to the kernel patch description, the prior implementation physically moved a hook from the base chain or flowtable’s
hook_list into a transaction list during the preparation phase of a deletion. That was unsafe because netlink dump operations can read the original list concurrently under Read-Copy-Update, or RCU, protections.In practical terms, the old logic changed a structure that other readers still expected to remain stable. A management tool enumerating nftables state through netlink could encounter inconsistent hook-list contents while another operation was removing a device hook. The patch restores the
NFT_HOOK_REMOVE flag and introduces a dedicated hook transaction object so deletion can be tracked without prematurely altering the RCU-protected list.That distinction matters. The kernel can now mark a hook as on its way out, preserve the active list through the transaction’s preparation, then finalize the removal through the proper transaction and event-notification paths.
Affected Releases Need Careful Reading
The CVE record’s affected-version data is unusual enough that IT teams should not make a quick “we are on a newer kernel” assumption. It identifies multiple affected development commits, lists affected stable ranges beginning with Linux 5.10.122, 5.15.47, 5.17.15, and 5.18.4, and then marks Linux 5.19 and later as affected until the fix line represented by Linux 7.1.The record also links two stable-kernel commits for the fix. That typically means maintainers have backported the correction into selected supported branches, rather than relying solely on the eventual upstream release. Distribution vendors may therefore ship the repair under a kernel package version that does not visibly match the mainline version cited in the CVE record.
Administrators should check the exact kernel package and vendor advisory, not simply compare
uname -r against “7.1.” Red Hat Enterprise Linux, Ubuntu, Debian, SUSE Linux Enterprise, Amazon Linux, Azure Linux, and appliance vendors regularly backport security fixes while retaining a familiar base version in the package name.The relevant source files are
include/net/netfilter/nf_tables.h and net/netfilter/nf_tables_api.c. Systems that have nftables installed but do not use netdev-family chains, device-bound base chains, or flowtable hooks may have a smaller practical exposure surface. That is not the same as being definitively unaffected, particularly for broadly configured network appliances or container hosts where firewall state is managed dynamically.Why Netlink Readers Are Part of the Security Story
The patch notes say the failure affects “netlink dump path readers.” Netlink is Linux’s kernel-to-userspace messaging interface, widely used bynft, iproute2, container platforms, network managers, monitoring agents, and orchestration systems to query or modify network state.A firewall configuration can therefore be correct in static tests while still triggering the faulty path during routine operational churn: a virtual interface disappearing, a bridge member being removed, a container network being torn down, or an automation system reconciling nftables rules while state is being queried.
The direct consequence described by the patch is an inconsistency in access to an RCU-protected list. The public CVE entry does not currently assign a weakness category, a CVSS vector, or an exploit scenario. It does not state that arbitrary code execution, privilege escalation, information disclosure, or a denial of service has been demonstrated.
That uncertainty should shape the response. It would be premature to describe CVE-2026-63858 as a critical remotely reachable nftables vulnerability. It would be equally mistaken to ignore it: kernel concurrency defects in packet filtering are exactly the kind of issue that can become disruptive under real-world network automation, and later security analysis can alter the severity picture.
Windows Estates Should Look Beyond the Desktop
A conventional Windows 11 workstation without a Linux VM or WSL 2 environment is not affected by this Linux kernel CVE. Microsoft’s Windows Filtering Platform, Windows Defender Firewall, and Hyper-V’s own host networking components are separate codebases.But Windows-centric estates often operate Linux in places that are easy to overlook:
- WSL 2 developer machines may run a Linux distribution with nftables-based local networking, test containers, or developer Kubernetes tooling.
- Hyper-V hosts may run Linux firewall appliances, router VMs, build runners, or container hosts that attach nftables policy to virtual interfaces.
- Windows Server administrators may manage Linux clusters through Windows Admin Center, PowerShell remoting, Azure Arc, or third-party monitoring platforms without seeing the kernel version at a glance.
- Mixed Azure environments may contain Linux network virtual appliances and workload nodes that use nftables or a higher-level tool that programs it.
netdev chains.Patch the Kernel, Then Validate the Firewall Stack
The right remediation is to install the vendor kernel update that incorporates the relevant stable backport and reboot into it when the distribution requires a reboot for the new kernel to take effect. Live patching may reduce restart pressure on supported enterprise distributions, but teams should confirm that the live-patch channel includes this specific change rather than assuming all published CVEs are covered.Before patching, establish whether the system uses the affected functionality.
nft list ruleset can reveal table netdev definitions, device-bound chain declarations, and flowtable configuration. Teams should also inspect automation that creates and destroys interfaces, including container networking, VLAN provisioning, bridge management, virtual Ethernet pairs, and VPN lifecycle scripts.After the update, validate both the kernel version and the operational path. A successful package installation is not enough if the host continues to boot an older kernel. Confirm the running release with
uname -r, verify the firewall ruleset still loads, and exercise controlled interface add/remove workflows on systems where dynamic network-device lifecycle events are normal.The NVD entry is only a day old as of July 20, and its missing severity assessment is the key unresolved point. For now, CVE-2026-63858 belongs in the next routine kernel-maintenance window for most environments—and nearer the front of the queue for nftables-heavy Linux infrastructure whose interfaces and firewall state are constantly in motion.
References
- Primary source: NVD / Linux Kernel
Published: 2026-07-20T01:04:00-07:00
NVD - CVE-2026-63858
nvd.nist.gov
- Security advisory: MSRC
Published: 2026-07-20T01:04:00-07:00
Original feed URL
Security Update Guide - Microsoft Security Response Center
msrc.microsoft.com
- Related coverage: git.toradex.cn
