CVE-2026-46101 (GCVE-0-2026-46101)
Vulnerability from cvelistv5
Published
2026-05-27 12:59
Modified
2026-06-14 17:54
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: reject zero shift in nft_bitwise Reject zero shift operands for nft_bitwise left and right shift expressions during initialization. The carry propagation logic computes the carry from the adjacent 32-bit word using BITS_PER_TYPE(u32) - shift. A zero shift operand turns this into a 32-bit shift, which is undefined behaviour. Reject zero shift operands in the control plane, alongside the existing check for values greater than or equal to 32, so malformed rules never reach the packet path.
Impacted products
Vendor Product Version
Linux Linux Version: 567d746b55bc66d3800c9ae91d50f0c5deb2fd93
Version: 567d746b55bc66d3800c9ae91d50f0c5deb2fd93
Version: 567d746b55bc66d3800c9ae91d50f0c5deb2fd93
Version: 567d746b55bc66d3800c9ae91d50f0c5deb2fd93
Version: 567d746b55bc66d3800c9ae91d50f0c5deb2fd93
Version: 567d746b55bc66d3800c9ae91d50f0c5deb2fd93
Version: 567d746b55bc66d3800c9ae91d50f0c5deb2fd93
Version: 567d746b55bc66d3800c9ae91d50f0c5deb2fd93
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_bitwise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9baa08d6b6b096fad70049533f0d705d85fdc979",
              "status": "affected",
              "version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
              "versionType": "git"
            },
            {
              "lessThan": "4fccea585631621c975883911a08d15b6671f7dc",
              "status": "affected",
              "version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
              "versionType": "git"
            },
            {
              "lessThan": "9ad26c272405f53834871cc2e46b9b5393a666c3",
              "status": "affected",
              "version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
              "versionType": "git"
            },
            {
              "lessThan": "bffef0acec9c3b837a785248a893137fb7f26c95",
              "status": "affected",
              "version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
              "versionType": "git"
            },
            {
              "lessThan": "ca24f1243ad1a4d12d6a23876bbbe3ed02099853",
              "status": "affected",
              "version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
              "versionType": "git"
            },
            {
              "lessThan": "6f820139d16a4c9865a145d4a9cf9c92cc632c14",
              "status": "affected",
              "version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
              "versionType": "git"
            },
            {
              "lessThan": "f370205974f171a5868c13ff30d7642fed46e47b",
              "status": "affected",
              "version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
              "versionType": "git"
            },
            {
              "lessThan": "fe11e5c40817b84abaa5d83bfb6586d8412bfd07",
              "status": "affected",
              "version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_bitwise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: reject zero shift in nft_bitwise\n\nReject zero shift operands for nft_bitwise left and right shift\nexpressions during initialization.\n\nThe carry propagation logic computes the carry from the adjacent 32-bit\nword using BITS_PER_TYPE(u32) - shift. A zero shift operand turns this\ninto a 32-bit shift, which is undefined behaviour.\n\nReject zero shift operands in the control plane, alongside the existing\ncheck for values greater than or equal to 32, so malformed rules never\nreach the packet path."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T17:54:30.068Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9baa08d6b6b096fad70049533f0d705d85fdc979"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fccea585631621c975883911a08d15b6671f7dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ad26c272405f53834871cc2e46b9b5393a666c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/bffef0acec9c3b837a785248a893137fb7f26c95"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca24f1243ad1a4d12d6a23876bbbe3ed02099853"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f820139d16a4c9865a145d4a9cf9c92cc632c14"
        },
        {
          "url": "https://git.kernel.org/stable/c/f370205974f171a5868c13ff30d7642fed46e47b"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe11e5c40817b84abaa5d83bfb6586d8412bfd07"
        }
      ],
      "title": "netfilter: reject zero shift in nft_bitwise",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46101",
    "datePublished": "2026-05-27T12:59:08.220Z",
    "dateReserved": "2026-05-13T15:03:33.097Z",
    "dateUpdated": "2026-06-14T17:54:30.068Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…

Loading…