CVE-2026-72350 (GCVE-0-2026-72350)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:43
VLAI
Title
netfilter: xt_u32: reject invalid shift counts
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_u32: reject invalid shift counts u32_match_it() executes rule-supplied shift operands on a 32-bit value. A malformed u32 rule can provide a shift count of 32 or more, triggering an undefined shift out-of-bounds during packet evaluation. Validate XT_U32_LEFTSH and XT_U32_RIGHTSH operands in u32_mt_checkentry() and reject malformed rules before they reach the packet path.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1b50b8a371e90a5e110f466e4ac02cf6b5f681de , < ca7c92d9701249e6daf132087756a88cbf2bb2a3 (git)
Affected: 1b50b8a371e90a5e110f466e4ac02cf6b5f681de , < b33b44250d57ab0e5a1e2571b5285fb0d0a7f382 (git)
Affected: 1b50b8a371e90a5e110f466e4ac02cf6b5f681de , < 728f479dc0447ae7eaef87926ff49142e415a811 (git)
Affected: 1b50b8a371e90a5e110f466e4ac02cf6b5f681de , < 0a8b7a6d763775709c601f584e709ae48bcc000a (git)
Affected: 1b50b8a371e90a5e110f466e4ac02cf6b5f681de , < cce42014415cecd98aa49b3950e7b02ee7c81268 (git)
Affected: 1b50b8a371e90a5e110f466e4ac02cf6b5f681de , < a597a722fb71a534138c20359b655726622b5f17 (git)
Affected: 1b50b8a371e90a5e110f466e4ac02cf6b5f681de , < 00d034fe8230dfc5832fe011ff2d81c1a2cc7a29 (git)
Affected: 1b50b8a371e90a5e110f466e4ac02cf6b5f681de , < 64cdf7d30ac18e43df6c48004435febb965809a8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.23
Unaffected: 0 , < 2.6.23 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/xt_u32.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ca7c92d9701249e6daf132087756a88cbf2bb2a3",
              "status": "affected",
              "version": "1b50b8a371e90a5e110f466e4ac02cf6b5f681de",
              "versionType": "git"
            },
            {
              "lessThan": "b33b44250d57ab0e5a1e2571b5285fb0d0a7f382",
              "status": "affected",
              "version": "1b50b8a371e90a5e110f466e4ac02cf6b5f681de",
              "versionType": "git"
            },
            {
              "lessThan": "728f479dc0447ae7eaef87926ff49142e415a811",
              "status": "affected",
              "version": "1b50b8a371e90a5e110f466e4ac02cf6b5f681de",
              "versionType": "git"
            },
            {
              "lessThan": "0a8b7a6d763775709c601f584e709ae48bcc000a",
              "status": "affected",
              "version": "1b50b8a371e90a5e110f466e4ac02cf6b5f681de",
              "versionType": "git"
            },
            {
              "lessThan": "cce42014415cecd98aa49b3950e7b02ee7c81268",
              "status": "affected",
              "version": "1b50b8a371e90a5e110f466e4ac02cf6b5f681de",
              "versionType": "git"
            },
            {
              "lessThan": "a597a722fb71a534138c20359b655726622b5f17",
              "status": "affected",
              "version": "1b50b8a371e90a5e110f466e4ac02cf6b5f681de",
              "versionType": "git"
            },
            {
              "lessThan": "00d034fe8230dfc5832fe011ff2d81c1a2cc7a29",
              "status": "affected",
              "version": "1b50b8a371e90a5e110f466e4ac02cf6b5f681de",
              "versionType": "git"
            },
            {
              "lessThan": "64cdf7d30ac18e43df6c48004435febb965809a8",
              "status": "affected",
              "version": "1b50b8a371e90a5e110f466e4ac02cf6b5f681de",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/xt_u32.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.23"
            },
            {
              "lessThan": "2.6.23",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_u32: reject invalid shift counts\n\nu32_match_it() executes rule-supplied shift operands on a 32-bit\nvalue. A malformed u32 rule can provide a shift count of 32 or more,\ntriggering an undefined shift out-of-bounds during packet evaluation.\n\nValidate XT_U32_LEFTSH and XT_U32_RIGHTSH operands in\nu32_mt_checkentry() and reject malformed rules before they reach the\npacket path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Malicious xt_u32 match rules are installed via IPT_SO_SET_REPLACE setsockopt or nftables NFNetlink (nft_compat match); per kernel CNA guidance netfilter/xtables rule setup is Local even though installed rules evaluate on ingress/egress packets through ipt_do_table.\nAC:L - The attacker fully controls XT_U32_LEFTSH/RIGHTSH shift operands (\u003e=32) in matchinfo and can send triggering packets through the hooked netfilter chain; no race or uncontrollable victim state is required.\nPR:L - Installing xt_u32 iptables/nftables rules requires CAP_NET_ADMIN, obtainable by unprivileged users in user/network namespaces via unshare -Urn; ip_tables.c and nfnetlink enforce ns_capable/netlink_net_capable against the namespace user_ns.\nUI:N - The attacker installs the malicious u32 match rule and generates matching traffic in their namespace; no separate victim action (opening files, mounting media, clicking links) is needed.\nS:U - Undefined shift during xt_u32 packet matching and any resulting kernel crash remain within the host kernel security authority; this is standard local kernel compromise, not a VM escape or sandbox boundary crossing.\nC:H - Undefined-behavior shifts on packet-derived u32 values corrupt val and @ offset accumulation, driving attacker-influenced skb_copy_bits reads at unintended offsets; per CNA guidance exploitable kernel memory-unsafe arithmetic warrants High confidentiality.\nI:H - Invalid shift counts corrupt val/at control flow in the u32_match_it hot path; C11 undefined behavior in kernel netfilter matching is exploitable for integrity compromise and potential code execution per CNA memory-corruption guidance.\nA:H - Evaluating a malformed xt_u32 rule with shift\u003e=32 triggers undefined shift-out-of-bounds during packet matching; vulnerable kernels also BUG() on skb_copy_bits failure, provoking kernel panic/oops during rule evaluation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:43:07.758Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ca7c92d9701249e6daf132087756a88cbf2bb2a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/b33b44250d57ab0e5a1e2571b5285fb0d0a7f382"
        },
        {
          "url": "https://git.kernel.org/stable/c/728f479dc0447ae7eaef87926ff49142e415a811"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a8b7a6d763775709c601f584e709ae48bcc000a"
        },
        {
          "url": "https://git.kernel.org/stable/c/cce42014415cecd98aa49b3950e7b02ee7c81268"
        },
        {
          "url": "https://git.kernel.org/stable/c/a597a722fb71a534138c20359b655726622b5f17"
        },
        {
          "url": "https://git.kernel.org/stable/c/00d034fe8230dfc5832fe011ff2d81c1a2cc7a29"
        },
        {
          "url": "https://git.kernel.org/stable/c/64cdf7d30ac18e43df6c48004435febb965809a8"
        }
      ],
      "title": "netfilter: xt_u32: reject invalid shift counts",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72350",
    "datePublished": "2026-08-15T05:55:53.532Z",
    "dateReserved": "2026-08-09T03:40:39.921Z",
    "dateUpdated": "2026-08-17T05:43:07.758Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72350",
      "date": "2026-09-21",
      "epss": "0.00176",
      "percentile": "0.07378"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/netfilter/xt_u32.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ca7c92d9701249e6daf132087756a88cbf2bb2a3",
                    "status": "affected",
                    "version": "1b50b8a371e90a5e110f466e4ac02cf6b5f681de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b33b44250d57ab0e5a1e2571b5285fb0d0a7f382",
                    "status": "affected",
                    "version": "1b50b8a371e90a5e110f466e4ac02cf6b5f681de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "728f479dc0447ae7eaef87926ff49142e415a811",
                    "status": "affected",
                    "version": "1b50b8a371e90a5e110f466e4ac02cf6b5f681de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0a8b7a6d763775709c601f584e709ae48bcc000a",
                    "status": "affected",
                    "version": "1b50b8a371e90a5e110f466e4ac02cf6b5f681de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cce42014415cecd98aa49b3950e7b02ee7c81268",
                    "status": "affected",
                    "version": "1b50b8a371e90a5e110f466e4ac02cf6b5f681de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a597a722fb71a534138c20359b655726622b5f17",
                    "status": "affected",
                    "version": "1b50b8a371e90a5e110f466e4ac02cf6b5f681de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "00d034fe8230dfc5832fe011ff2d81c1a2cc7a29",
                    "status": "affected",
                    "version": "1b50b8a371e90a5e110f466e4ac02cf6b5f681de",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "64cdf7d30ac18e43df6c48004435febb965809a8",
                    "status": "affected",
                    "version": "1b50b8a371e90a5e110f466e4ac02cf6b5f681de",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/netfilter/xt_u32.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.23"
                  },
                  {
                    "lessThan": "2.6.23",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_u32: reject invalid shift counts\n\nu32_match_it() executes rule-supplied shift operands on a 32-bit\nvalue. A malformed u32 rule can provide a shift count of 32 or more,\ntriggering an undefined shift out-of-bounds during packet evaluation.\n\nValidate XT_U32_LEFTSH and XT_U32_RIGHTSH operands in\nu32_mt_checkentry() and reject malformed rules before they reach the\npacket path."
          }
        ],
        "id": "CVE-2026-72350",
        "lastModified": "2026-08-17T06:18:39.020",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:08.407",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/00d034fe8230dfc5832fe011ff2d81c1a2cc7a29"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0a8b7a6d763775709c601f584e709ae48bcc000a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/64cdf7d30ac18e43df6c48004435febb965809a8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/728f479dc0447ae7eaef87926ff49142e415a811"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a597a722fb71a534138c20359b655726622b5f17"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b33b44250d57ab0e5a1e2571b5285fb0d0a7f382"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ca7c92d9701249e6daf132087756a88cbf2bb2a3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cce42014415cecd98aa49b3950e7b02ee7c81268"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-19T17:16:17+00:00",
      "cve": "CVE-2026-72350",
      "id": "CVE-2026-72350",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "166",
      "product_status:known_not_affected": "108",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: xt_u32: reject invalid shift counts",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72350.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-09-15T01:26:43Z",
      "cve": "CVE-2026-72350",
      "id": "CVE-2026-72350",
      "initial_release_date": "2026-09-01T13:29:41Z",
      "product_status:known_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72350",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72350.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.