{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-72320", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.919Z", "datePublished": "2026-08-15T05:55:32.939Z", "dateUpdated": "2026-08-17T05:42:46.791Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:42:46.791Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_lookup: fix catchall element handling with inverted lookups\n\nnft_lookup_eval() decides whether a lookup matched (`found`) from the\ndirect set lookup and priv->invert before falling back to the\ncatchall element used by interval sets (e.g. nft_set_rbtree) for the\nopen-ended default range. Since `found` is never recomputed after\n`ext` is replaced by the catchall lookup, inverted lookups\n(NFT_LOOKUP_F_INV, \"!= @set\") can wrongly match or wrongly skip the\ncatchall element, producing the wrong verdict. Fold the catchall\nlookup into `ext` before computing `found`, matching the order\nalready used by nft_objref_map_eval()." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - nft_lookup_eval() runs on the netfilter packet datapath via nft_do_chain() for ingress/forward/prerouting hooks, so a remote sender can reach the bug by sending packets evaluated against an affected inverted lookup rule on a catchall interval set.\nAC:L - Once such a ruleset exists, the attacker reliably controls whether the lookup key hits a set element or the catchall by crafting packet fields; no race, memory layout dependency, or other uncontrollable victim state is required.\nPR:N - Exploitation at runtime only requires sending network traffic through the victim's nftables hooks; although rule installation needs CAP_NET_ADMIN, the remote attacker needs no credentials or local privileges on the target system.\nUI:N - No victim user interaction is needed beyond normal network traffic processing; the kernel automatically evaluates the inverted lookup expression for each matching packet.\nS:U - The impact is incorrect nftables verdicts within the host/kernel network security authority and does not cross VM, container-host, or IOMMU security boundaries.\nC:H - Wrongly matching or skipping the catchall element can bypass intended filtering and expose protected internal services or data that the firewall policy was meant to block from the attacker's network position.\nI:H - The bug can apply or omit catchall set-element actions and verdicts (accept/drop/jump), allowing unauthorized traffic handling contrary to the administrator's intended nftables policy.\nA:N - This is a pure logic error that returns incorrect verdicts without memory corruption, kernel oops/panic, hang, or other direct loss of kernel availability." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/netfilter/nft_lookup.c" ], "versions": [ { "version": "aaa31047a6d25da0fa101da1ed544e1247949b40", "lessThan": "0ab8880865f9678eb6174e72c1fc4712e44c745c", "status": "affected", "versionType": "git" }, { "version": "aaa31047a6d25da0fa101da1ed544e1247949b40", "lessThan": "238c612357b5a25f03eacf356f95034f8551f218", "status": "affected", "versionType": "git" }, { "version": "aaa31047a6d25da0fa101da1ed544e1247949b40", "lessThan": "ef0c7d4b04a0e6ad175323c24bc84e11470dd79d", "status": "affected", "versionType": "git" }, { "version": "aaa31047a6d25da0fa101da1ed544e1247949b40", "lessThan": "e6107a4c74b54cb33e3bce162a63048ae5a6b198", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/netfilter/nft_lookup.c" ], "versions": [ { "version": "5.13", "status": "affected" }, { "version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.12.97" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.18.40" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.1.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/0ab8880865f9678eb6174e72c1fc4712e44c745c" }, { "url": "https://git.kernel.org/stable/c/238c612357b5a25f03eacf356f95034f8551f218" }, { "url": "https://git.kernel.org/stable/c/ef0c7d4b04a0e6ad175323c24bc84e11470dd79d" }, { "url": "https://git.kernel.org/stable/c/e6107a4c74b54cb33e3bce162a63048ae5a6b198" } ], "title": "netfilter: nft_lookup: fix catchall element handling with inverted lookups", "x_generator": { "engine": "bippy-1.2.0" } } } }