CVE-2026-64076

Source
https://cve.org/CVERecord?id=CVE-2026-64076
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64076.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-64076
Downstream
AZL (1)
BELL (1)
DEBIAN (1)
OESA (1)
ROOT (3)
UBUNTU (1)
Published
2026-07-19T15:39:50Z
Modified
2026-11-01T02:30:41Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
netfilter: bridge: eb_tables: close module init race
Details

In the Linux kernel, the following vulnerability has been resolved:

netfilter: bridge: eb_tables: close module init race

sashiko reports for unrelated patch: Does the core ebtables initialization in ebtables.c suffer from a similar race? Once nf_register_sockopt() completes, the sockopts are exposed globally.

sockopt has to be registered last, just like in ip/ip6/arptables.

Database specific
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64076.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5b53951cfc85329d29df9d07b1e905f4563546a5
Fixed
e0e7dec9dfc02987598e6a42bdfcab51dcc43e10
Fixed
5fc488f46086d17e8e545d8104ddd95b175de218
Fixed
6bb35bdaabb22fd2d86b601904e928dbaa537941
Fixed
c647e2a21bbbaceda6cdb8a44a56f44d231dc4b4
Fixed
02d999dc69b3918dba2414932b5d95f1f75c76cb
Fixed
27414ff1b287ea9a2a11675149ec28e05539f3cc

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64076.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.13.0
Fixed
6.1.191
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.160
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.114
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.34
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.0.11

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64076.json"