Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-72350

netfilter: xt_u32: reject invalid shift counts

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_u32: reject invalid shift counts u32_match_it() executes rule-supplied shift operands on a 32-bit value. A malformed u32 rule can provide a shift count of 32 or more, triggering an undefined shift out-of-bounds during packet evaluation. Validate XT_U32_LEFTSH and XT_U32_RIGHTSH operands in u32_mt_checkentry() and reject malformed rules before they reach the packet path.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From 1b50b8a371e90a5e110f466e4ac02cf6b5f681de · fixed in ca7c92d9701249e6daf132087756a88cbf2bb2a3; From 1b50b8a371e90a5e110f466e4ac02cf6b5f681de · fixed in b33b44250d57ab0e5a1e2571b5285fb0d0a7f382; From 1b50b8a371e90a5e110f466e4ac02cf6b5f681de · fixed in 728f479dc0447ae7eaef87926ff49142e415a811; From 1b50b8a371e90a5e110f466e4ac02cf6b5f681de · fixed in 0a8b7a6d763775709c601f584e709ae48bcc000a; From 1b50b8a371e90a5e110f466e4ac02cf6b5f681de · fixed in cce42014415cecd98aa49b3950e7b02ee7c81268; From 1b50b8a371e90a5e110f466e4ac02cf6b5f681de · fixed in a597a722fb71a534138c20359b655726622b5f17; From 1b50b8a371e90a5e110f466e4ac02cf6b5f681de · fixed in 00d034fe8230dfc5832fe011ff2d81c1a2cc7a29; From 1b50b8a371e90a5e110f466e4ac02cf6b5f681de · fixed in 64cdf7d30ac18e43df6c48004435febb965809a8

  • Linux Linux

    2.6.23

  • KernelLinux

    From 2.6.23 · fixed in 5.10.261; From 5.11.0 · fixed in 5.15.212; From 5.16.0 · fixed in 6.1.178; From 6.2.0 · fixed in 6.6.145; From 6.7.0 · fixed in 6.12.97; From 6.13.0 · fixed in 6.18.40; From 6.19.0 · fixed in 7.1.5

References 8

git.kernel.org