CVE-2026-64410

Estado: AnalizadaCrítica (9.8)—

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: IPIP tunnel hardware offload is not yet support

No driver supports for IPIP tunnels yet, give up early on setting up the hardware offload for this scenario.

This patch adds a stub that can be enhanced to add more configuration that are currently not supported. As of now, the offload work is enqueued to the worker, then ignored if the hardware offload configuration is not supported.

Check the NF_FLOW_HW flag to know if this entry was already tried once to be offloaded so this is not retried on refresh when unsupported. Move NF_FLOW_HW flag check to nf_flow_offload_add(). If this NF_FLOW_HW flag is unset the _del and _stats variants are never called.

Leer descripción completaMostrar menos

This can be updated later on to skip hardware offload work to be queued in case hardware offload does not support it.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 9.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.55%
Percentil entre todas las CVEs puntuadas: 44
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access85 %

Vulnerabilidad crítica en kernel Linux (AV:N, sin autenticación) que afecta offload de hardware en netfilter. El vector de red sin privilegios y la descripción de fallo en configuración de hardware pueden causar DoS por mal funcionamiento de filtrado de tráfico.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability Scanning Privileged Account Management Network Segmentation Limit Access to Resource Over Network Filter Network Traffic Application Isolation and Sandboxing

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

NVD-CWE-noinfo

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-64410",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "ab427db17885814069bae891834f20842f0ac3a4",
              "lessThan": "9efe838c13133acb70c78d04c49e8362fe533566",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ab427db17885814069bae891834f20842f0ac3a4",
              "lessThan": "6c5dcab95f4cd42a1648739ec9300fbb4b1a021f",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "include/net/netfilter/nf_flow_table.h",
            "net/netfilter/nf_flow_table_core.c",
            "net/netfilter/nf_flow_table_offload.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.19",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "include/net/netfilter/nf_flow_table.h",
            "net/netfilter/nf_flow_table_core.c",
            "net/netfilter/nf_flow_table_offload.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-07-25T10:17:24.753",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/6c5dcab95f4cd42a1648739ec9300fbb4b1a021f",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9efe838c13133acb70c78d04c49e8362fe533566",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: IPIP tunnel hardware offload is not yet support\n\nNo driver supports for IPIP tunnels yet, give up early on setting up the\nhardware offload for this scenario.\n\nThis patch adds a stub that can be enhanced to add more configuration\nthat are currently not supported. As of now, the offload work is\nenqueued to the worker, then ignored if the hardware offload\nconfiguration is not supported.\n\nCheck the NF_FLOW_HW flag to know if this entry was already tried once\nto be offloaded so this is not retried on refresh when unsupported. Move\nNF_FLOW_HW flag check to nf_flow_offload_add(). If this NF_FLOW_HW flag\nis unset the _del and _stats variants are never called.\n\nThis can be updated later on to skip hardware offload work to be queued\nin case hardware offload does not support it."
    }
  ],
  "lastModified": "2026-09-04T15:26:59.797",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
              "versionEndExcluding": "7.1.4",
              "versionStartIncluding": "6.19"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E8B9085-7ADB-4A05-89EF-12949B6A0509"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1FC0D50D-9D58-4947-A197-A5A3FF07E7E3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}