[Bug] Cowork VM Kernel Panic in xt_net_init during bwrap Network Namespace Creation

Bug Description
Root Cause: Kernel crashes in the Cowork VM

The coworkd.log shows the Cowork Linux VM is experiencing repeated kernel panics that crash the entire VM every time it tries to run plugin operations. Here's the sequence from today
(Feb 19):

1. Line 2318: Cowork spawns claude plugin list --json --available --cowork inside the VM
2. Line 2330: The VM kernel immediately crashes:

Internal error: Oops - Undefined instruction: 0000000002000000 [#1] SMP

1. The crash is in xt_net_init (iptables/x_tables module) triggered by bwrap (bubblewrap sandbox) trying to create a network namespace.
2. Line 2368: The plugin process exits with code 139 (SIGSEGV)
3. Lines 2381-2592: A cascade of 6 more kernel Oops follows (NULL pointer dereferences in seccomp, bpf_prog_free, __pi_strlen)
4. Line 2637: Kernel panic - Attempted to kill init! - the VM is dead
5. Line 2643+: The VM reboots automatically

This same crash pattern has been happening repeatedly: Feb 9, 10, 12, 13, 16, and 19. The Feb 16 swift log also confirms: VM stopped with error: The virtual machine stopped
unexpectedly.

What's happening

The VM runs Ubuntu with kernel 6.8.0-94-generic on Apple Virtualization (ARM64). There appears to be a kernel bug in the x_tables/iptables module within this specific VM image. Every
time bwrap (used for sandboxing plugin installs) tries to create a new network namespace, the kernel crashes.

Environment Info

• Platform: darwin
• Terminal: iTerm.app
• Version: 2.1.47
• Feedback ID: 572e7e47-9274-4945-ad63-2402e1904294

Errors

[{"error":"RangeError: stdout maxBuffer length exceeded\n    at unknown\n    at onData (node:child_process:153:110)\n    at emit (node:events:95:22)\n    at addChunk (internal:streams/readable:264:47)\n    at readableAddChunkPushByteMode (internal:streams/readable:242:18)\n    at handleNumberResult (internal:streams/native-readable:69:18)\n    at <anonymous> (internal:streams/native-readable:43:68)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-02-19T12:57:31.770Z"},{"error":"Error: File does not exist.\n    at call (/$bunfs/root/claude:1337:6219)\n    at async <anonymous> (/$bunfs/root/claude:5809:2090)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-02-19T12:58:27.833Z"},{"error":"Error\n    at call (/$bunfs/root/claude:1337:6219)\n    at async <anonymous> (/$bunfs/root/claude:5809:2090)\n    at processTicksAndRejections (unknown:7:39)","timestamp":"2026-02-19T12:58:29.979Z"},{"error":"FileTooLargeError: File content (446.9KB) exceeds maximum allowed size (256KB). Please use offset and limit parameters to read specific portions of the file, or use the GrepTool to search for specific content.\n    at hZ_ (/$bunfs/root/claude:1161:402)\n    at async ZY_ (/$bunfs/root/claude:1332:2402)\n    at async call (/$bunfs/root/claude:1337:5924)\n    at async hO8 (/$bunfs/root/claude:3376:14313)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-02-19T13:08:51.368Z"},{"error":"FileTooLargeError: File content (446.9KB) exceeds maximum allowed size (256KB). Please use offset and limit parameters to read specific portions of the file, or use the GrepTool to search for specific content.\n    at hZ_ (/$bunfs/root/claude:1161:402)\n    at async ZY_ (/$bunfs/root/claude:1332:2402)\n    at async call (/$bunfs/root/claude:1337:5924)\n    at async hO8 (/$bunfs/root/claude:3376:14313)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-02-19T13:09:01.824Z"}]