netfilter: nft_lookup: fix catchall element handling with inverted lookups
Affects Linux kernel nftables setups that use inverted lookups against sets with a catchall element, such as interval sets. Fixed in 6.6.160, 6.12.97, 6.18.40 and 7.1.5.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 6.6.160, 6.12.97, 6.18.40, 7.1.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
The Linux kernel's netfilter packet filtering component, specifically its nftables lookup logic, is affected. Inverted set lookups (such as "!= @set" rules) that involve catchall elements in interval sets can match or skip packets incorrectly, leading to the wrong filtering verdict.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_lookup: fix catchall element handling with inverted lookups nft_lookup_eval() decides whether a lookup matched (`found`) from the direct set lookup and priv->invert before falling back to the catchall element used by interval sets (e.g. nft_set_rbtree) for the open-ended default range. Since `found` is never recomputed after `ext` is replaced by the catchall lookup, inverted lookups (NFT_LOOKUP_F_INV, "!= @set") can wrongly match or wrongly skip the catchall element, producing the wrong verdict. Fold the catchall lookup into `ext` before computing `found`, matching the order already used by nft_objref_map_eval().
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
Version range not reported
- Linux Linux
5.13
- KernelLinux
From 5.13.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.97; From 6.13.0 · fixed in 6.18.40; From 6.19.0 · fixed in 7.1.5
References 6
git.kernel.org
Questions about CVE-2026-72320
What does this mean?
Inverted nftables lookups (the != @set form) can produce the wrong verdict for a catchall element, so the element may be wrongly matched or wrongly skipped.Source: git.kernel.org
Am I affected, and how do I check?
Affected kernels run from 5.13.0 up to the fixed release for each branch (6.6.160, 6.12.97, 6.18.40, 7.1.5). The bug needs an inverted lookup against a set with a catchall element, such as an interval set. Check the kernel version with uname -r and look for lookups written as != @set in nft rules.Source: git.kernel.org
What should I do about it?
Update to the fixed kernel for the branch in use: 6.6.160, 6.12.97, 6.18.40, or 7.1.5 or later.Source: git.kernel.org
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data