CVE-2026-74564 (GCVE-0-2026-74564)
Vulnerability from cvelistv5
Published
2026-08-15 12:28
Modified
2026-08-19 16:39
Severity ?
7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH The XT_HASHLIMIT_RATE_MATCH flag mode changes the semantics of the dsthash_ent structure which represents an entry in the hashtable. There is a union area which uses a different layout to express the rate match mode. Update .checkentry path to validate the XT_HASHLIMIT_RATE_MATCH mode flag is requested by two or more different rules that refer to the same hashtable. Otherwise, uninitialized access to the burst field in the union is possible. Reject the use of the XT_HASHLIMIT_RATE_MATCH mode flag if set on by revision less than 3 too.
References
Impacted products
Vendor Product Version
Linux Linux Version: bea74641e3786d51dcf1175527cc1781420961c9
Version: bea74641e3786d51dcf1175527cc1781420961c9
Version: bea74641e3786d51dcf1175527cc1781420961c9
Version: bea74641e3786d51dcf1175527cc1781420961c9
Version: bea74641e3786d51dcf1175527cc1781420961c9
Version: bea74641e3786d51dcf1175527cc1781420961c9
Version: bea74641e3786d51dcf1175527cc1781420961c9
Version: bea74641e3786d51dcf1175527cc1781420961c9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/xt_hashlimit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "402befce5854c195058cf4bab7c78ca286068a26",
              "status": "affected",
              "version": "bea74641e3786d51dcf1175527cc1781420961c9",
              "versionType": "git"
            },
            {
              "lessThan": "dee686b5e7f21180538ff719867702f411c8eb5c",
              "status": "affected",
              "version": "bea74641e3786d51dcf1175527cc1781420961c9",
              "versionType": "git"
            },
            {
              "lessThan": "f76ab783e7d8d33e33dd7dfa697297f70d57b0e8",
              "status": "affected",
              "version": "bea74641e3786d51dcf1175527cc1781420961c9",
              "versionType": "git"
            },
            {
              "lessThan": "24683fea1f06bd3bd2707b99460e859bc6464c22",
              "status": "affected",
              "version": "bea74641e3786d51dcf1175527cc1781420961c9",
              "versionType": "git"
            },
            {
              "lessThan": "32ec8d4aba2cf22e12bdc28df8c4bd833c195fc0",
              "status": "affected",
              "version": "bea74641e3786d51dcf1175527cc1781420961c9",
              "versionType": "git"
            },
            {
              "lessThan": "d186f77d18bdfb252d401ff992ca3001a6a65a0f",
              "status": "affected",
              "version": "bea74641e3786d51dcf1175527cc1781420961c9",
              "versionType": "git"
            },
            {
              "lessThan": "06a76334243ccd875a981aa8bb46c0f931ef1e3b",
              "status": "affected",
              "version": "bea74641e3786d51dcf1175527cc1781420961c9",
              "versionType": "git"
            },
            {
              "lessThan": "305b63e1402267459fdabb183af4527f6799eebf",
              "status": "affected",
              "version": "bea74641e3786d51dcf1175527cc1781420961c9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/xt_hashlimit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH\n\nThe XT_HASHLIMIT_RATE_MATCH flag mode changes the semantics of the\ndsthash_ent structure which represents an entry in the hashtable.  There\nis a union area which uses a different layout to express the rate match\nmode.\n\nUpdate .checkentry path to validate the XT_HASHLIMIT_RATE_MATCH mode\nflag is requested by two or more different rules that refer to the same\nhashtable. Otherwise, uninitialized access to the burst field in the\nunion is possible.\n\nReject the use of the XT_HASHLIMIT_RATE_MATCH mode flag if set on by\nrevision less than 3 too."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires installing conflicting xt_hashlimit iptables rules via the IPT_SO_SET_REPLACE netlink path (CAP_NET_ADMIN), which is local netfilter configuration per kernel CVSS guidance; the uninitialized burst read occurs later during packet matching in hashlimit_mt_common().\nAC:L - An attacker with CAP_NET_ADMIN can deterministically install two rules sharing one hashtable name\u2014one standard hashlimit and one with XT_HASHLIMIT_RATE_MATCH\u2014so the first packet evaluated by both rules triggers uninitialized burst access without races or external timing.\nPR:L - Installing iptables hashlimit rules requires CAP_NET_ADMIN, which unprivileged users can obtain in their own network namespace via user namespaces (unshare -Urn) on common Linux distributions, containers, and Kubernetes workloads with NET_ADMIN capability.\nUI:N - No victim interaction is required; once the conflicting hashlimit rules are installed, the attacker fully controls exploitation by sending network packets that traverse the affected iptables hooks (INPUT, FORWARD, PREROUTING).\nS:U - Impact is confined to kernel netfilter hashlimit state and packet-filtering decisions within the target network namespace; it does not cross a VM, container-to-host, or IOMMU security boundary.\nC:H - The rate-match path reads an uninitialized burst field from kmem_cache-allocated dsthash_ent entries whose standard-mode initialization only writes the first 24 bytes of the rateinfo union, exposing stale kernel slab heap contents.\nI:H - Cross-mode union aliasing causes rate-match logic to read uninitialized burst and write current_rate/prev_window over credit/credit_cap/cost fields, corrupting shared hashtable entries and enabling arbitrary firewall match verdict manipulation (type confusion).\nA:N - The vulnerability causes uninitialized memory reads and union field corruption affecting match results, but does not trigger kernel oops, panic, hang, or host-level denial of service; impact is incorrect packet classification rather than system crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:39:04.869Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/402befce5854c195058cf4bab7c78ca286068a26"
        },
        {
          "url": "https://git.kernel.org/stable/c/dee686b5e7f21180538ff719867702f411c8eb5c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f76ab783e7d8d33e33dd7dfa697297f70d57b0e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/24683fea1f06bd3bd2707b99460e859bc6464c22"
        },
        {
          "url": "https://git.kernel.org/stable/c/32ec8d4aba2cf22e12bdc28df8c4bd833c195fc0"
        },
        {
          "url": "https://git.kernel.org/stable/c/d186f77d18bdfb252d401ff992ca3001a6a65a0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/06a76334243ccd875a981aa8bb46c0f931ef1e3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/305b63e1402267459fdabb183af4527f6799eebf"
        }
      ],
      "title": "netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74564",
    "datePublished": "2026-08-15T12:28:06.392Z",
    "dateReserved": "2026-08-15T05:44:03.916Z",
    "dateUpdated": "2026-08-19T16:39:04.869Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.