Critical· 9.8official fix available
CVE-2026-64410
A critical flaw in the Linux kernel’s netfilter flowtable handling could allow attackers to exploit IPIP tunnel hardware offload. The issue has been fixed in a recent kernel patch.
publishedJul 25, 2026
last modifiedJul 27, 2026
sourcesNVD
severity · cvss
9.8
critical · how bad it is
exploitation · epss
<1%
31th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 26, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
All Linux kernel users that run a kernel version before the fix, especially those using netfilter flowtable with IPIP tunnels.
02
Real-world impact
An attacker could potentially gain full control of the affected system, including confidentiality, integrity, and availability.
03
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network with no authentication or user interaction, and can lead to complete compromise.
04
What to do about it
official fix available
recommended steps
- 01Upgrade the Linux kernel to a version that includes the CVE-2026-64410 fix.
- 02Reboot the system to load the new kernel.
NVD-referenced vendor advisory
05
Timeline
- Jul 25, 2026 · 7d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 27, 2026 · 5d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07
References & advisories
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →