CVE-2026-72347 (GCVE-0-2026-72347)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:43
VLAI
Title
netfilter: xt_connmark: reject invalid shift parameters
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_connmark: reject invalid shift parameters Revision 2 of the CONNMARK target accepts user-controlled shift parameters and applies them to 32-bit mark values in connmark_tg_shift(). A shift_bits value of 32 or more triggers an undefined-shift bug when the rule is evaluated. Invalid shift_dir values are also accepted and silently fall back to the left-shift path. Reject invalid revision-2 shift parameters in connmark_tg_check() so malformed rules fail at installation time, before they can reach the packet path.
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 472a73e00757b971d613d796374d2727b2e4954d , < d8ce63d928b457fba7ed1e302492dfd32293671c (git)
Affected: 472a73e00757b971d613d796374d2727b2e4954d , < 9657bb11a6376ab0a79f05d433713d6944111e9d (git)
Affected: 472a73e00757b971d613d796374d2727b2e4954d , < 8ace320ac4416f5e5fbcd065309fb2dfcce787b0 (git)
Affected: 472a73e00757b971d613d796374d2727b2e4954d , < c3fa852d117b3fda72265e4230e3967db4a74fcf (git)
Affected: 472a73e00757b971d613d796374d2727b2e4954d , < 4eef84b09a3836919360c4232b0f16651a155eec (git)
Affected: 472a73e00757b971d613d796374d2727b2e4954d , < 230173cc6105bdfb2696d37e6e56687b003fbe63 (git)
Affected: 472a73e00757b971d613d796374d2727b2e4954d , < 1b47026fb4b35bac850ad6e8a4ad7fc018e09ebc (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.17
Unaffected: 0 , < 4.17 (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/xt_connmark.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d8ce63d928b457fba7ed1e302492dfd32293671c",
              "status": "affected",
              "version": "472a73e00757b971d613d796374d2727b2e4954d",
              "versionType": "git"
            },
            {
              "lessThan": "9657bb11a6376ab0a79f05d433713d6944111e9d",
              "status": "affected",
              "version": "472a73e00757b971d613d796374d2727b2e4954d",
              "versionType": "git"
            },
            {
              "lessThan": "8ace320ac4416f5e5fbcd065309fb2dfcce787b0",
              "status": "affected",
              "version": "472a73e00757b971d613d796374d2727b2e4954d",
              "versionType": "git"
            },
            {
              "lessThan": "c3fa852d117b3fda72265e4230e3967db4a74fcf",
              "status": "affected",
              "version": "472a73e00757b971d613d796374d2727b2e4954d",
              "versionType": "git"
            },
            {
              "lessThan": "4eef84b09a3836919360c4232b0f16651a155eec",
              "status": "affected",
              "version": "472a73e00757b971d613d796374d2727b2e4954d",
              "versionType": "git"
            },
            {
              "lessThan": "230173cc6105bdfb2696d37e6e56687b003fbe63",
              "status": "affected",
              "version": "472a73e00757b971d613d796374d2727b2e4954d",
              "versionType": "git"
            },
            {
              "lessThan": "1b47026fb4b35bac850ad6e8a4ad7fc018e09ebc",
              "status": "affected",
              "version": "472a73e00757b971d613d796374d2727b2e4954d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/xt_connmark.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_connmark: reject invalid shift parameters\n\nRevision 2 of the CONNMARK target accepts user-controlled shift\nparameters and applies them to 32-bit mark values in\nconnmark_tg_shift().\n\nA shift_bits value of 32 or more triggers an undefined-shift bug when\nthe rule is evaluated. Invalid shift_dir values are also accepted and\nsilently fall back to the left-shift path.\n\nReject invalid revision-2 shift parameters in connmark_tg_check() so\nmalformed rules fail at installation time, before they can reach the\npacket path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Malformed CONNMARK rev2 rules are installed via IPT_SO_SET_REPLACE setsockopt or nftables NFNetlink (nft_compat); per kernel CNA guidance netfilter/xtables rule setup is Local even though installed rules later evaluate on ingress/egress packets through ipt_do_table/ip6t_do_table.\nAC:L - The attacker fully controls shift_bits and shift_dir in xt_connmark_tginfo2 when installing the rev2 CONNMARK target and can send conntrack-tracked packets to reliably hit connmark_tg_shift(); no race, memory layout, or victim state outside attacker control is required.\nPR:L - Installing CONNMARK iptables/nftables rules requires CAP_NET_ADMIN in the target network namespace, obtainable by unprivileged users via unshare -Urn; ip_tables.c do_ipt_set_ctl() and nfnetlink.c nfnetlink_rcv() enforce ns_capable/netlink_net_capable against the namespace user_ns.\nUI:N - The attacker installs the malformed CONNMARK rev2 rule and generates matching conntrack-associated traffic in their namespace; no separate victim action such as opening files, mounting media, or clicking links is required.\nS:U - Undefined shift during xt_CONNMARK packet targeting and resulting mark corruption remain within the host kernel security authority; this is standard local kernel netfilter compromise, not a VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:L - Undefined-behavior shifts on 32-bit mark values produce attacker-influenced unpredictable ct-\u003emark and skb-\u003emark results observable through conntrack netlink and mark-based iptables/nftables matches, leaking altered connection-classification state within the namespace.\nI:H - Invalid shift_bits or shift_dir corrupt connmark_tg_shift() output written to nf_conn-\u003emark and skb-\u003emark, subverting mark-dependent firewall, policy-routing, QoS, and multi-tenant container egress controls on cloud routers and internet-facing servers.\nA:H - Evaluating a malformed CONNMARK rev2 rule with shift_bits\u003e=32 triggers C11 undefined-shift UB in connmark_tg_shift() during softirq netfilter processing; UBSAN-instrumented kernels panic on shift-out-of-bounds, and UB in the packet hot path can destabilize conntrack-driven forwarding."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:43:05.530Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d8ce63d928b457fba7ed1e302492dfd32293671c"
        },
        {
          "url": "https://git.kernel.org/stable/c/9657bb11a6376ab0a79f05d433713d6944111e9d"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ace320ac4416f5e5fbcd065309fb2dfcce787b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3fa852d117b3fda72265e4230e3967db4a74fcf"
        },
        {
          "url": "https://git.kernel.org/stable/c/4eef84b09a3836919360c4232b0f16651a155eec"
        },
        {
          "url": "https://git.kernel.org/stable/c/230173cc6105bdfb2696d37e6e56687b003fbe63"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b47026fb4b35bac850ad6e8a4ad7fc018e09ebc"
        }
      ],
      "title": "netfilter: xt_connmark: reject invalid shift parameters",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72347",
    "datePublished": "2026-08-15T05:55:51.665Z",
    "dateReserved": "2026-08-09T03:40:39.920Z",
    "dateUpdated": "2026-08-17T05:43:05.530Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72347",
      "date": "2026-09-21",
      "epss": "0.00174",
      "percentile": "0.07114"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/netfilter/xt_connmark.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d8ce63d928b457fba7ed1e302492dfd32293671c",
                    "status": "affected",
                    "version": "472a73e00757b971d613d796374d2727b2e4954d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9657bb11a6376ab0a79f05d433713d6944111e9d",
                    "status": "affected",
                    "version": "472a73e00757b971d613d796374d2727b2e4954d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8ace320ac4416f5e5fbcd065309fb2dfcce787b0",
                    "status": "affected",
                    "version": "472a73e00757b971d613d796374d2727b2e4954d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c3fa852d117b3fda72265e4230e3967db4a74fcf",
                    "status": "affected",
                    "version": "472a73e00757b971d613d796374d2727b2e4954d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4eef84b09a3836919360c4232b0f16651a155eec",
                    "status": "affected",
                    "version": "472a73e00757b971d613d796374d2727b2e4954d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "230173cc6105bdfb2696d37e6e56687b003fbe63",
                    "status": "affected",
                    "version": "472a73e00757b971d613d796374d2727b2e4954d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1b47026fb4b35bac850ad6e8a4ad7fc018e09ebc",
                    "status": "affected",
                    "version": "472a73e00757b971d613d796374d2727b2e4954d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/netfilter/xt_connmark.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.17"
                  },
                  {
                    "lessThan": "4.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_connmark: reject invalid shift parameters\n\nRevision 2 of the CONNMARK target accepts user-controlled shift\nparameters and applies them to 32-bit mark values in\nconnmark_tg_shift().\n\nA shift_bits value of 32 or more triggers an undefined-shift bug when\nthe rule is evaluated. Invalid shift_dir values are also accepted and\nsilently fall back to the left-shift path.\n\nReject invalid revision-2 shift parameters in connmark_tg_check() so\nmalformed rules fail at installation time, before they can reach the\npacket path."
          }
        ],
        "id": "CVE-2026-72347",
        "lastModified": "2026-08-17T06:18:38.643",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.5,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:08.070",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1b47026fb4b35bac850ad6e8a4ad7fc018e09ebc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/230173cc6105bdfb2696d37e6e56687b003fbe63"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4eef84b09a3836919360c4232b0f16651a155eec"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8ace320ac4416f5e5fbcd065309fb2dfcce787b0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9657bb11a6376ab0a79f05d433713d6944111e9d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c3fa852d117b3fda72265e4230e3967db4a74fcf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d8ce63d928b457fba7ed1e302492dfd32293671c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-19T17:51:10+00:00",
      "cve": "CVE-2026-72347",
      "id": "CVE-2026-72347",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: xt_connmark: reject invalid shift parameters",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72347.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:26:47Z",
      "cve": "CVE-2026-72347",
      "id": "CVE-2026-72347",
      "initial_release_date": "2026-09-01T13:29:44Z",
      "product_status:known_affected": "269",
      "product_status:known_not_affected": "93",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72347",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72347.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.