Vulnerability-Lookup

GHSA-MHJ7-JJGW-7GMC

Vulnerability from github – Published: 2026-08-15 15:30 – Updated: 2026-08-19 18:32

Details

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH

The XT_HASHLIMIT_RATE_MATCH flag mode changes the semantics of the dsthash_ent structure which represents an entry in the hashtable. There is a union area which uses a different layout to express the rate match mode.

Update .checkentry path to validate the XT_HASHLIMIT_RATE_MATCH mode flag is requested by two or more different rules that refer to the same hashtable. Otherwise, uninitialized access to the burst field in the union is possible.

Reject the use of the XT_HASHLIMIT_RATE_MATCH mode flag if set on by revision less than 3 too.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-74564"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T13:18:01Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH\n\nThe XT_HASHLIMIT_RATE_MATCH flag mode changes the semantics of the\ndsthash_ent structure which represents an entry in the hashtable.  There\nis a union area which uses a different layout to express the rate match\nmode.\n\nUpdate .checkentry path to validate the XT_HASHLIMIT_RATE_MATCH mode\nflag is requested by two or more different rules that refer to the same\nhashtable. Otherwise, uninitialized access to the burst field in the\nunion is possible.\n\nReject the use of the XT_HASHLIMIT_RATE_MATCH mode flag if set on by\nrevision less than 3 too.",
  "id": "GHSA-mhj7-jjgw-7gmc",
  "modified": "2026-08-19T18:32:32Z",
  "published": "2026-08-15T15:30:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74564"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/06a76334243ccd875a981aa8bb46c0f931ef1e3b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/24683fea1f06bd3bd2707b99460e859bc6464c22"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/305b63e1402267459fdabb183af4527f6799eebf"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/32ec8d4aba2cf22e12bdc28df8c4bd833c195fc0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/402befce5854c195058cf4bab7c78ca286068a26"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d186f77d18bdfb252d401ff992ca3001a6a65a0f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dee686b5e7f21180538ff719867702f411c8eb5c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f76ab783e7d8d33e33dd7dfa697297f70d57b0e8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-74564 (GCVE-0-2026-74564)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:28 – Updated: 2026-08-19 16:39

Title

netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH The XT_HASHLIMIT_RATE_MATCH flag mode changes the semantics of the dsthash_ent structure which represents an entry in the hashtable. There is a union area which uses a different layout to express the rate match mode. Update .checkentry path to validate the XT_HASHLIMIT_RATE_MATCH mode flag is requested by two or more different rules that refer to the same hashtable. Otherwise, uninitialized access to the burst field in the union is possible. Reject the use of the XT_HASHLIMIT_RATE_MATCH mode flag if set on by revision less than 3 too.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Assigner

Linux CNA under the mitre root

CNA scorecard D 54/100 over 6624 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/402befce5854c1950…
https://git.kernel.org/stable/c/dee686b5e7f211805…
https://git.kernel.org/stable/c/f76ab783e7d8d33e3…
https://git.kernel.org/stable/c/24683fea1f06bd3bd…
https://git.kernel.org/stable/c/32ec8d4aba2cf22e1…
https://git.kernel.org/stable/c/d186f77d18bdfb252…
https://git.kernel.org/stable/c/06a76334243ccd875…
https://git.kernel.org/stable/c/305b63e1402267459…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: bea74641e3786d51dcf1175527cc1781420961c9 , < 402befce5854c195058cf4bab7c78ca286068a26 (git) Affected: bea74641e3786d51dcf1175527cc1781420961c9 , < dee686b5e7f21180538ff719867702f411c8eb5c (git) Affected: bea74641e3786d51dcf1175527cc1781420961c9 , < f76ab783e7d8d33e33dd7dfa697297f70d57b0e8 (git) Affected: bea74641e3786d51dcf1175527cc1781420961c9 , < 24683fea1f06bd3bd2707b99460e859bc6464c22 (git) Affected: bea74641e3786d51dcf1175527cc1781420961c9 , < 32ec8d4aba2cf22e12bdc28df8c4bd833c195fc0 (git) Affected: bea74641e3786d51dcf1175527cc1781420961c9 , < d186f77d18bdfb252d401ff992ca3001a6a65a0f (git) Affected: bea74641e3786d51dcf1175527cc1781420961c9 , < 06a76334243ccd875a981aa8bb46c0f931ef1e3b (git) Affected: bea74641e3786d51dcf1175527cc1781420961c9 , < 305b63e1402267459fdabb183af4527f6799eebf (git)
Linux	Linux	Affected: 4.14 Unaffected: 0 , < 4.14 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/xt_hashlimit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "402befce5854c195058cf4bab7c78ca286068a26",
              "status": "affected",
              "version": "bea74641e3786d51dcf1175527cc1781420961c9",
              "versionType": "git"
            },
            {
              "lessThan": "dee686b5e7f21180538ff719867702f411c8eb5c",
              "status": "affected",
              "version": "bea74641e3786d51dcf1175527cc1781420961c9",
              "versionType": "git"
            },
            {
              "lessThan": "f76ab783e7d8d33e33dd7dfa697297f70d57b0e8",
              "status": "affected",
              "version": "bea74641e3786d51dcf1175527cc1781420961c9",
              "versionType": "git"
            },
            {
              "lessThan": "24683fea1f06bd3bd2707b99460e859bc6464c22",
              "status": "affected",
              "version": "bea74641e3786d51dcf1175527cc1781420961c9",
              "versionType": "git"
            },
            {
              "lessThan": "32ec8d4aba2cf22e12bdc28df8c4bd833c195fc0",
              "status": "affected",
              "version": "bea74641e3786d51dcf1175527cc1781420961c9",
              "versionType": "git"
            },
            {
              "lessThan": "d186f77d18bdfb252d401ff992ca3001a6a65a0f",
              "status": "affected",
              "version": "bea74641e3786d51dcf1175527cc1781420961c9",
              "versionType": "git"
            },
            {
              "lessThan": "06a76334243ccd875a981aa8bb46c0f931ef1e3b",
              "status": "affected",
              "version": "bea74641e3786d51dcf1175527cc1781420961c9",
              "versionType": "git"
            },
            {
              "lessThan": "305b63e1402267459fdabb183af4527f6799eebf",
              "status": "affected",
              "version": "bea74641e3786d51dcf1175527cc1781420961c9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/xt_hashlimit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH\n\nThe XT_HASHLIMIT_RATE_MATCH flag mode changes the semantics of the\ndsthash_ent structure which represents an entry in the hashtable.  There\nis a union area which uses a different layout to express the rate match\nmode.\n\nUpdate .checkentry path to validate the XT_HASHLIMIT_RATE_MATCH mode\nflag is requested by two or more different rules that refer to the same\nhashtable. Otherwise, uninitialized access to the burst field in the\nunion is possible.\n\nReject the use of the XT_HASHLIMIT_RATE_MATCH mode flag if set on by\nrevision less than 3 too."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires installing conflicting xt_hashlimit iptables rules via the IPT_SO_SET_REPLACE netlink path (CAP_NET_ADMIN), which is local netfilter configuration per kernel CVSS guidance; the uninitialized burst read occurs later during packet matching in hashlimit_mt_common().\nAC:L - An attacker with CAP_NET_ADMIN can deterministically install two rules sharing one hashtable name\u2014one standard hashlimit and one with XT_HASHLIMIT_RATE_MATCH\u2014so the first packet evaluated by both rules triggers uninitialized burst access without races or external timing.\nPR:L - Installing iptables hashlimit rules requires CAP_NET_ADMIN, which unprivileged users can obtain in their own network namespace via user namespaces (unshare -Urn) on common Linux distributions, containers, and Kubernetes workloads with NET_ADMIN capability.\nUI:N - No victim interaction is required; once the conflicting hashlimit rules are installed, the attacker fully controls exploitation by sending network packets that traverse the affected iptables hooks (INPUT, FORWARD, PREROUTING).\nS:U - Impact is confined to kernel netfilter hashlimit state and packet-filtering decisions within the target network namespace; it does not cross a VM, container-to-host, or IOMMU security boundary.\nC:H - The rate-match path reads an uninitialized burst field from kmem_cache-allocated dsthash_ent entries whose standard-mode initialization only writes the first 24 bytes of the rateinfo union, exposing stale kernel slab heap contents.\nI:H - Cross-mode union aliasing causes rate-match logic to read uninitialized burst and write current_rate/prev_window over credit/credit_cap/cost fields, corrupting shared hashtable entries and enabling arbitrary firewall match verdict manipulation (type confusion).\nA:N - The vulnerability causes uninitialized memory reads and union field corruption affecting match results, but does not trigger kernel oops, panic, hang, or host-level denial of service; impact is incorrect packet classification rather than system crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:39:04.869Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/402befce5854c195058cf4bab7c78ca286068a26"
        },
        {
          "url": "https://git.kernel.org/stable/c/dee686b5e7f21180538ff719867702f411c8eb5c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f76ab783e7d8d33e33dd7dfa697297f70d57b0e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/24683fea1f06bd3bd2707b99460e859bc6464c22"
        },
        {
          "url": "https://git.kernel.org/stable/c/32ec8d4aba2cf22e12bdc28df8c4bd833c195fc0"
        },
        {
          "url": "https://git.kernel.org/stable/c/d186f77d18bdfb252d401ff992ca3001a6a65a0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/06a76334243ccd875a981aa8bb46c0f931ef1e3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/305b63e1402267459fdabb183af4527f6799eebf"
        }
      ],
      "title": "netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74564",
    "datePublished": "2026-08-15T12:28:06.392Z",
    "dateReserved": "2026-08-15T05:44:03.916Z",
    "dateUpdated": "2026-08-19T16:39:04.869Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-MHJ7-JJGW-7GMC

CVE-2026-74564 (GCVE-0-2026-74564)

Tags

Sightings

Nomenclature

Related by attack behaviour