CVE-2026-74564 (GCVE-0-2026-74564)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:48
VLAI
Title
netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH The XT_HASHLIMIT_RATE_MATCH flag mode changes the semantics of the dsthash_ent structure which represents an entry in the hashtable. There is a union area which uses a different layout to express the rate match mode. Update .checkentry path to validate the XT_HASHLIMIT_RATE_MATCH mode flag is requested by two or more different rules that refer to the same hashtable. Otherwise, uninitialized access to the burst field in the union is possible. Reject the use of the XT_HASHLIMIT_RATE_MATCH mode flag if set on by revision less than 3 too.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bea74641e3786d51dcf1175527cc1781420961c9 , < 24683fea1f06bd3bd2707b99460e859bc6464c22 (git)
Affected: bea74641e3786d51dcf1175527cc1781420961c9 , < 32ec8d4aba2cf22e12bdc28df8c4bd833c195fc0 (git)
Affected: bea74641e3786d51dcf1175527cc1781420961c9 , < d186f77d18bdfb252d401ff992ca3001a6a65a0f (git)
Affected: bea74641e3786d51dcf1175527cc1781420961c9 , < 06a76334243ccd875a981aa8bb46c0f931ef1e3b (git)
Affected: bea74641e3786d51dcf1175527cc1781420961c9 , < 305b63e1402267459fdabb183af4527f6799eebf (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.14
Unaffected: 0 , < 4.14 (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/xt_hashlimit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "24683fea1f06bd3bd2707b99460e859bc6464c22",
              "status": "affected",
              "version": "bea74641e3786d51dcf1175527cc1781420961c9",
              "versionType": "git"
            },
            {
              "lessThan": "32ec8d4aba2cf22e12bdc28df8c4bd833c195fc0",
              "status": "affected",
              "version": "bea74641e3786d51dcf1175527cc1781420961c9",
              "versionType": "git"
            },
            {
              "lessThan": "d186f77d18bdfb252d401ff992ca3001a6a65a0f",
              "status": "affected",
              "version": "bea74641e3786d51dcf1175527cc1781420961c9",
              "versionType": "git"
            },
            {
              "lessThan": "06a76334243ccd875a981aa8bb46c0f931ef1e3b",
              "status": "affected",
              "version": "bea74641e3786d51dcf1175527cc1781420961c9",
              "versionType": "git"
            },
            {
              "lessThan": "305b63e1402267459fdabb183af4527f6799eebf",
              "status": "affected",
              "version": "bea74641e3786d51dcf1175527cc1781420961c9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/xt_hashlimit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH\n\nThe XT_HASHLIMIT_RATE_MATCH flag mode changes the semantics of the\ndsthash_ent structure which represents an entry in the hashtable.  There\nis a union area which uses a different layout to express the rate match\nmode.\n\nUpdate .checkentry path to validate the XT_HASHLIMIT_RATE_MATCH mode\nflag is requested by two or more different rules that refer to the same\nhashtable. Otherwise, uninitialized access to the burst field in the\nunion is possible.\n\nReject the use of the XT_HASHLIMIT_RATE_MATCH mode flag if set on by\nrevision less than 3 too."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires installing conflicting xt_hashlimit iptables rules via the IPT_SO_SET_REPLACE netlink path (CAP_NET_ADMIN), which is local netfilter configuration per kernel CVSS guidance; the uninitialized burst read occurs later during packet matching in hashlimit_mt_common().\nAC:L - An attacker with CAP_NET_ADMIN can deterministically install two rules sharing one hashtable name\u2014one standard hashlimit and one with XT_HASHLIMIT_RATE_MATCH\u2014so the first packet evaluated by both rules triggers uninitialized burst access without races or external timing.\nPR:L - Installing iptables hashlimit rules requires CAP_NET_ADMIN, which unprivileged users can obtain in their own network namespace via user namespaces (unshare -Urn) on common Linux distributions, containers, and Kubernetes workloads with NET_ADMIN capability.\nUI:N - No victim interaction is required; once the conflicting hashlimit rules are installed, the attacker fully controls exploitation by sending network packets that traverse the affected iptables hooks (INPUT, FORWARD, PREROUTING).\nS:U - Impact is confined to kernel netfilter hashlimit state and packet-filtering decisions within the target network namespace; it does not cross a VM, container-to-host, or IOMMU security boundary.\nC:H - The rate-match path reads an uninitialized burst field from kmem_cache-allocated dsthash_ent entries whose standard-mode initialization only writes the first 24 bytes of the rateinfo union, exposing stale kernel slab heap contents.\nI:H - Cross-mode union aliasing causes rate-match logic to read uninitialized burst and write current_rate/prev_window over credit/credit_cap/cost fields, corrupting shared hashtable entries and enabling arbitrary firewall match verdict manipulation (type confusion).\nA:N - The vulnerability causes uninitialized memory reads and union field corruption affecting match results, but does not trigger kernel oops, panic, hang, or host-level denial of service; impact is incorrect packet classification rather than system crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:48:44.158Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/24683fea1f06bd3bd2707b99460e859bc6464c22"
        },
        {
          "url": "https://git.kernel.org/stable/c/32ec8d4aba2cf22e12bdc28df8c4bd833c195fc0"
        },
        {
          "url": "https://git.kernel.org/stable/c/d186f77d18bdfb252d401ff992ca3001a6a65a0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/06a76334243ccd875a981aa8bb46c0f931ef1e3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/305b63e1402267459fdabb183af4527f6799eebf"
        }
      ],
      "title": "netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74564",
    "datePublished": "2026-08-15T12:28:06.392Z",
    "dateReserved": "2026-08-15T05:44:03.916Z",
    "dateUpdated": "2026-08-17T05:48:44.158Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74564",
      "date": "2026-08-18",
      "epss": "0.00117",
      "percentile": "0.01968"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74564\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T13:18:01.903\",\"lastModified\":\"2026-08-17T06:19:54.533\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH\\n\\nThe XT_HASHLIMIT_RATE_MATCH flag mode changes the semantics of the\\ndsthash_ent structure which represents an entry in the hashtable.  There\\nis a union area which uses a different layout to express the rate match\\nmode.\\n\\nUpdate .checkentry path to validate the XT_HASHLIMIT_RATE_MATCH mode\\nflag is requested by two or more different rules that refer to the same\\nhashtable. Otherwise, uninitialized access to the burst field in the\\nunion is possible.\\n\\nReject the use of the XT_HASHLIMIT_RATE_MATCH mode flag if set on by\\nrevision less than 3 too.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/netfilter/xt_hashlimit.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"bea74641e3786d51dcf1175527cc1781420961c9\",\"lessThan\":\"24683fea1f06bd3bd2707b99460e859bc6464c22\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bea74641e3786d51dcf1175527cc1781420961c9\",\"lessThan\":\"32ec8d4aba2cf22e12bdc28df8c4bd833c195fc0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bea74641e3786d51dcf1175527cc1781420961c9\",\"lessThan\":\"d186f77d18bdfb252d401ff992ca3001a6a65a0f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bea74641e3786d51dcf1175527cc1781420961c9\",\"lessThan\":\"06a76334243ccd875a981aa8bb46c0f931ef1e3b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bea74641e3786d51dcf1175527cc1781420961c9\",\"lessThan\":\"305b63e1402267459fdabb183af4527f6799eebf\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/netfilter/xt_hashlimit.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.151\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.103\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.8\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/06a76334243ccd875a981aa8bb46c0f931ef1e3b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/24683fea1f06bd3bd2707b99460e859bc6464c22\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/305b63e1402267459fdabb183af4527f6799eebf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/32ec8d4aba2cf22e12bdc28df8c4bd833c195fc0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d186f77d18bdfb252d401ff992ca3001a6a65a0f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-17T16:25:05Z",
      "cve": "CVE-2026-74564",
      "id": "CVE-2026-74564",
      "initial_release_date": "2026-08-15T23:50:06Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74564",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74564.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.