CVE-2026-74579 (GCVE-0-2026-74579)
Vulnerability from cvelistv5
Published
2026-08-17 05:28
Modified
2026-08-25 05:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_payload: fix mask build for partial field offload
nft_payload_offload_mask() builds the offload match mask for a payload
expression that covers only part of a header field. For a partial IPv6
address match (field_len = 16, priv_len = 1) that shift is 1 << 120, which
is undefined on the 32-bit int operand. It also trims only one word, so
the remaining words stay 0xffffffff (and when priv_len is a multiple of 4
the trim is skipped entirely), leaving the mask covering more bytes than
the rule matches.
UBSAN: shift-out-of-bounds in net/netfilter/nft_payload.c:278:20
shift exponent 120 is too large for 32-bit type 'int'
...
The match is byte-granular and struct nft_data is zero-initialised, so the
correct mask is simply the first priv_len bytes set to 0xff. Set those
bytes directly and drop the word/shift trimming; this removes the undefined
shift and no longer over-masks the trailing bytes.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a5d45bc0dc50f9dd83703510e9804d813a9cac32 Version: a5d45bc0dc50f9dd83703510e9804d813a9cac32 Version: a5d45bc0dc50f9dd83703510e9804d813a9cac32 Version: a5d45bc0dc50f9dd83703510e9804d813a9cac32 Version: a5d45bc0dc50f9dd83703510e9804d813a9cac32 Version: a5d45bc0dc50f9dd83703510e9804d813a9cac32 Version: a5d45bc0dc50f9dd83703510e9804d813a9cac32 Version: a5d45bc0dc50f9dd83703510e9804d813a9cac32 Version: 5c2b4b4f9fa5b765b927e361e3d310bcb5773015 Version: 5.9.14 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_payload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3ee7b3f813b11f28cd6efdf7f24d64b5a7fd4dc7",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "8720df4504e0ed1781a702f65251bd47b3534d5e",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "363c3a84a946d53e5e121c9f47c7c2b7d228c46b",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "b19b5d2e042c294e2cc1c908dc598f9d64015396",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "a375d8ace807767f29f276b681b6324c74929b1d",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "16b553c46e347bc9de9946c4960654d5884a86de",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "630295d5bba1d0e0f494cc459452eb0a0058c545",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "39e88f28fb32bf02bd4b525c24c842c9cff5663d",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"status": "affected",
"version": "5c2b4b4f9fa5b765b927e361e3d310bcb5773015",
"versionType": "git"
},
{
"lessThan": "5.10",
"status": "affected",
"version": "5.9.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_payload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.9.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_payload: fix mask build for partial field offload\n\nnft_payload_offload_mask() builds the offload match mask for a payload\nexpression that covers only part of a header field. For a partial IPv6\naddress match (field_len = 16, priv_len = 1) that shift is 1 \u003c\u003c 120, which\nis undefined on the 32-bit int operand. It also trims only one word, so\nthe remaining words stay 0xffffffff (and when priv_len is a multiple of 4\nthe trim is skipped entirely), leaving the mask covering more bytes than\nthe rule matches.\n\n UBSAN: shift-out-of-bounds in net/netfilter/nft_payload.c:278:20\n shift exponent 120 is too large for 32-bit type \u0027int\u0027\n ...\n\nThe match is byte-granular and struct nft_data is zero-initialised, so the\ncorrect mask is simply the first priv_len bytes set to 0xff. Set those\nbytes directly and drop the word/shift trimming; this removes the undefined\nshift and no longer over-masks the trailing bytes."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached only when installing nftables rules via NETLINK_NETFILTER (NFT_MSG_NEWRULE) on NFT_CHAIN_HW_OFFLOAD netdev ingress chains; nft_flow_rule_create() calls nft_payload_offload_mask() during expr offload setup, which is a local netlink syscall path per kernel CNA guidance for nftables/netfilter.\nAC:L - An attacker with CAP_NET_ADMIN can deterministically craft a partial-field payload match (e.g., priv_len=1 on IPv6 saddr with field_len=16) on an HW-offload chain; no race, memory layout, or other conditions outside attacker control are required to hit the undefined shift and incorrect mask build.\nPR:L - All nf_tables netlink operations are gated by netlink_net_capable(skb, CAP_NET_ADMIN) in nfnetlink_rcv(), checked against the socket network namespace user_ns; unprivileged local users routinely obtain CAP_NET_ADMIN via user+network namespaces (unshare -Urn) on cloud hosts and containers.\nUI:N - No victim interaction is required; the attacker installs the malformed HW-offload nftables rule through their own netlink socket and triggers the bug during rule commit without needing another user to mount filesystems, open files, or take any action.\nS:U - Impact is confined to the host kernel and its hardware-offloaded netdev ingress filtering policy (incorrect TC flower masks, potential kernel crash); this is standard kernel/network-authority impact, not a VM escape, IOMMU bypass, or cross-security-boundary scope change.\nC:N - The bug corrupts on-stack bitmask construction during rule installation and does not perform out-of-bounds reads, use-after-free, or other memory-disclosure primitives; no attacker-influenced kernel memory read path exists beyond incorrect mask values.\nI:H - Incorrect or UB-corrupted HW flower match masks misprogram NIC ingress ACLs on hardware-offloaded edge firewalls, causing accept/drop/redirect actions to apply to traffic contrary to administrator intent; this is exploitable integrity compromise of enforced network policy on internet-facing offload deployments.\nA:H - The undefined shift (1\u003c\u003c120) triggers documented UBSAN shift-out-of-bounds at rule install and can panic/oops on UBSAN/trap kernels; misprogrammed HW offload masks can also blackhole or mis-drop production ingress traffic on netdev-offloaded chains, satisfying CNA high availability guidance."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:40:05.144Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3ee7b3f813b11f28cd6efdf7f24d64b5a7fd4dc7"
},
{
"url": "https://git.kernel.org/stable/c/8720df4504e0ed1781a702f65251bd47b3534d5e"
},
{
"url": "https://git.kernel.org/stable/c/363c3a84a946d53e5e121c9f47c7c2b7d228c46b"
},
{
"url": "https://git.kernel.org/stable/c/b19b5d2e042c294e2cc1c908dc598f9d64015396"
},
{
"url": "https://git.kernel.org/stable/c/a375d8ace807767f29f276b681b6324c74929b1d"
},
{
"url": "https://git.kernel.org/stable/c/16b553c46e347bc9de9946c4960654d5884a86de"
},
{
"url": "https://git.kernel.org/stable/c/630295d5bba1d0e0f494cc459452eb0a0058c545"
},
{
"url": "https://git.kernel.org/stable/c/39e88f28fb32bf02bd4b525c24c842c9cff5663d"
}
],
"title": "netfilter: nft_payload: fix mask build for partial field offload",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74579",
"datePublished": "2026-08-17T05:28:27.768Z",
"dateReserved": "2026-08-15T05:44:03.917Z",
"dateUpdated": "2026-08-25T05:40:05.144Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…