A high-severity Linux kernel vulnerability (CVE-2026-64077) was published on July 19, 2026, and it’s not just a problem for Linux admins. With a CVSS score of 7.8, the bug targets the ebtables network filter, and on a Windows PC, it can sneak in through WSL 2, Docker Desktop, or any Linux virtual machine. Microsoft’s own advisory acknowledged the issue on July 21, and upstream patches are already available – meaning it’s time to check every Linux kernel you run alongside Windows.

What’s the flaw, exactly?

The vulnerability lives in ebtables, a Linux component that filters Ethernet bridge traffic. It’s a legacy subsystem, but it still lurks in many modern kernels. The bug is a race condition: when ebtables tables are registered or removed, an attacker with local access could manipulate the process to gain higher privileges, crash the system, or tamper with network traffic. The kernel.org CNA assigned a base score of CVSS 7.8, indicating local attack vector, low complexity, low privileges required, and high impact on confidentiality, integrity, and availability.

The flaw was introduced in Linux kernel 5.15, a long-term release still widely used. All kernels from 5.15 onward are potentially affected unless patched. Upstream fixes have been released in Linux 6.18.34, 7.0.11, and 7.1. If you see a kernel version between 5.15 and those numbers, you’re likely exposed.

What’s at stake for you?

For Windows users, the risk depends entirely on how you use Linux.

Home developers and enthusiasts

If you run WSL 2, your default Linux kernel is provided by Microsoft and updated through wsl --update. Many installations still run kernels in the 5.15 range, which may be vulnerable. A local attacker who gains access to your WSL environment – perhaps through a malicious script or compromised development tools – could exploit the bug to escalate privileges inside that Linux VM. That puts your source code, credentials, and any mounted Windows drives at risk.

Docker Desktop also uses a Linux VM under the hood. Even if you never open a terminal, your containers could be affected. Home lab setups, NAS devices running Linux, and virtual machines on Hyper-V or VirtualBox all need a kernel patch.

IT admins and enterprises

Organizations that host Linux VMs on Windows Server (Hyper-V) or use Kubernetes workers are in the danger zone. A compromised container or guest VM could exploit this vulnerability to break out of its namespace and take over the host kernel. That’s a classic privilege escalation chain. Servers that allow multiple users to spin up containers or VMs are particularly tempting targets.

Microsoft’s advisory (MSRC CVE-2026-64077) makes clear that while Windows itself isn’t affected, the Linux kernels running under your management are your responsibility. If you treat them as “just the Hyper-V guest” and neglect patching, you’re leaving a door open.

Mixed Windows–Linux environments

Many organizations run Linux appliances, edge devices, or cloud instances that are managed from a Windows admin console. The vulnerability doesn’t care where the management interface sits. Every Linux kernel from 5.15 onward must be audited, regardless of whether its primary admin interface is a Windows desktop.

How did this happen?

Ebtables has been part of the Linux kernel for decades, handling Layer 2 Ethernet filtering. In 2021, kernel 5.15 introduced a code change to prevent ebtables tables from being automatically hooked. That change inadvertently created a synchronization flaw in how tables are registered and torn down. When multiple network namespaces or module loads interact, a race condition can expose partially initialized or already-freed memory.

The fix mirrors earlier work in the related x_tables subsystem: tables are now moved to a “dead” list before final cleanup, ensuring that no active code can reach them after they’re marked for removal. The patch also tightens registration so that a table isn’t made visible until it’s fully initialized. These changes are small but critical.

How to patch your system right now

Don’t wait for an exploit to appear. Here’s what to do, based on how you use Linux on Windows:

For WSL 2 users

  1. Update the Microsoft WSL kernel: Open PowerShell or Command Prompt and run:
    wsl --update
    This fetches the latest Microsoft-provided kernel. If you’re using a custom kernel (check wsl --status), switch back to the default for automatic updates.

  2. Verify your kernel version: Inside any WSL distribution, run:
    uname -r
    Look for a version number. If it shows 5.15.x or any 6.x below 6.18.34, you’re not covered yet. The updated Microsoft kernel may carry a backported fix even if the version string looks older, but the safest approach is to watch for Microsoft’s explicit confirmation in the MSRC advisory.

  3. Restart WSL: After updating, shut down all WSL instances:
    wsl --shutdown
    Then reopen your terminals. The new kernel won’t be used until you do this.

For Docker Desktop users

Docker Desktop bundles its own Linux VM. Update to the latest stable version from Docker’s website or the app’s built-in updater. After updating, restart Docker Desktop. It will spin up the new VM with the patched kernel. If you rely on Docker for critical workloads, verify the kernel version inside a container shell with uname -r.

For Linux VMs (Hyper-V, VirtualBox, VMware)

Treat these like any Linux server. Log into the VM and use the distribution’s package manager:

sudo apt update && sudo apt upgrade   # Debian/Ubuntu
sudo yum update                       # RHEL/CentOS/Fedora
sudo zypper update                    # openSUSE

Then reboot the VM. Check the kernel version with uname -r. If your distribution hasn’t yet backported the fix, you’ll need to wait for a security advisory. However, major distributions usually respond quickly. For enterprise environments, rely on your vendor’s patch management tools.

For enterprise admins

  • Inventory all Linux kernels running on your Windows-managed infrastructure, including VMs, containers, and appliances. Tools like Microsoft Defender for Cloud can help if you have the appropriate integrations.
  • Prioritize multi-tenant hosts where low-privileged users can run code in containers or VMs.
  • Test patching in a canary group before rolling out widely, especially if you rely on complex bridge networking or legacy ebtables rules.
  • Reboot every patched machine – a kernel update on disk isn’t active until reboot. Plan for downtime or live migration where possible.

What to expect next

The National Vulnerability Database (NVD) hasn’t yet published its own CVSS assessment, but the kernel.org CNA’s 7.8 High score is likely to hold. Distribution maintainers are backporting the fix, and you’ll soon see security advisories from Red Hat, Ubuntu, SUSE, and others that mention CVE-2026-64077 explicitly.

Exploit code isn’t public yet, but patch analysis often leads to proof-of-concept development. The fact that the flaw is in a local, legacy subsystem doesn’t mean it’s obscure – many automation tools still use ebtables for bridge filtering. The window for safe patching is now, before attackers turn the proof of concept into weaponized exploits.

For Windows users, the takeaway is clear: Linux under Windows is real Linux, with real Linux bugs. Update your WSL kernel, update Docker Desktop, and schedule a reboot. The patch is small; the risk is not.