🟠 High | Source: Microsoft Security Response Center
CVE-2026-64077 is a Linux kernel vulnerability affecting the netfilter ebtables subsystem, which handles network packet filtering at the Ethernet bridge layer. The fix introduces a two-stage removal scheme to address a likely use-after-free or race condition during rule cleanup. This is relevant to Azure because many Azure Linux-based virtual machines and container workloads rely on the kernel’s netfilter subsystem for network security enforcement.
Security Architect’s Take: Review your Azure Linux VM and AKS node pool configurations to confirm patched kernel versions are deployed once Microsoft releases updated images; prioritise workloads where ebtables or bridge-level network filtering is in use, and consider enabling automatic OS image updates on node pools to reduce exposure window.
Original advisory: CVE-2026-64077 netfilter: ebtables: move to two-stage removal scheme