{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74579","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-15T05:44:03.917Z","datePublished":"2026-08-17T05:28:27.768Z","dateUpdated":"2026-08-25T05:40:05.144Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-25T05:40:05.144Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_payload: fix mask build for partial field offload\n\nnft_payload_offload_mask() builds the offload match mask for a payload\nexpression that covers only part of a header field.  For a partial IPv6\naddress match (field_len = 16, priv_len = 1) that shift is 1 << 120, which\nis undefined on the 32-bit int operand.  It also trims only one word, so\nthe remaining words stay 0xffffffff (and when priv_len is a multiple of 4\nthe trim is skipped entirely), leaving the mask covering more bytes than\nthe rule matches.\n\n  UBSAN: shift-out-of-bounds in net/netfilter/nft_payload.c:278:20\n  shift exponent 120 is too large for 32-bit type 'int'\n  ...\n\nThe match is byte-granular and struct nft_data is zero-initialised, so the\ncorrect mask is simply the first priv_len bytes set to 0xff. Set those\nbytes directly and drop the word/shift trimming; this removes the undefined\nshift and no longer over-masks the trailing bytes."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is reached only when installing nftables rules via NETLINK_NETFILTER (NFT_MSG_NEWRULE) on NFT_CHAIN_HW_OFFLOAD netdev ingress chains; nft_flow_rule_create() calls nft_payload_offload_mask() during expr offload setup, which is a local netlink syscall path per kernel CNA guidance for nftables/netfilter.\nAC:L - An attacker with CAP_NET_ADMIN can deterministically craft a partial-field payload match (e.g., priv_len=1 on IPv6 saddr with field_len=16) on an HW-offload chain; no race, memory layout, or other conditions outside attacker control are required to hit the undefined shift and incorrect mask build.\nPR:L - All nf_tables netlink operations are gated by netlink_net_capable(skb, CAP_NET_ADMIN) in nfnetlink_rcv(), checked against the socket network namespace user_ns; unprivileged local users routinely obtain CAP_NET_ADMIN via user+network namespaces (unshare -Urn) on cloud hosts and containers.\nUI:N - No victim interaction is required; the attacker installs the malformed HW-offload nftables rule through their own netlink socket and triggers the bug during rule commit without needing another user to mount filesystems, open files, or take any action.\nS:U - Impact is confined to the host kernel and its hardware-offloaded netdev ingress filtering policy (incorrect TC flower masks, potential kernel crash); this is standard kernel/network-authority impact, not a VM escape, IOMMU bypass, or cross-security-boundary scope change.\nC:N - The bug corrupts on-stack bitmask construction during rule installation and does not perform out-of-bounds reads, use-after-free, or other memory-disclosure primitives; no attacker-influenced kernel memory read path exists beyond incorrect mask values.\nI:H - Incorrect or UB-corrupted HW flower match masks misprogram NIC ingress ACLs on hardware-offloaded edge firewalls, causing accept/drop/redirect actions to apply to traffic contrary to administrator intent; this is exploitable integrity compromise of enforced network policy on internet-facing offload deployments.\nA:H - The undefined shift (1<<120) triggers documented UBSAN shift-out-of-bounds at rule install and can panic/oops on UBSAN/trap kernels; misprogrammed HW offload masks can also blackhole or mis-drop production ingress traffic on netdev-offloaded chains, satisfying CNA high availability guidance."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nft_payload.c"],"versions":[{"version":"a5d45bc0dc50f9dd83703510e9804d813a9cac32","lessThan":"3ee7b3f813b11f28cd6efdf7f24d64b5a7fd4dc7","status":"affected","versionType":"git"},{"version":"a5d45bc0dc50f9dd83703510e9804d813a9cac32","lessThan":"8720df4504e0ed1781a702f65251bd47b3534d5e","status":"affected","versionType":"git"},{"version":"a5d45bc0dc50f9dd83703510e9804d813a9cac32","lessThan":"363c3a84a946d53e5e121c9f47c7c2b7d228c46b","status":"affected","versionType":"git"},{"version":"a5d45bc0dc50f9dd83703510e9804d813a9cac32","lessThan":"b19b5d2e042c294e2cc1c908dc598f9d64015396","status":"affected","versionType":"git"},{"version":"a5d45bc0dc50f9dd83703510e9804d813a9cac32","lessThan":"a375d8ace807767f29f276b681b6324c74929b1d","status":"affected","versionType":"git"},{"version":"a5d45bc0dc50f9dd83703510e9804d813a9cac32","lessThan":"16b553c46e347bc9de9946c4960654d5884a86de","status":"affected","versionType":"git"},{"version":"a5d45bc0dc50f9dd83703510e9804d813a9cac32","lessThan":"630295d5bba1d0e0f494cc459452eb0a0058c545","status":"affected","versionType":"git"},{"version":"a5d45bc0dc50f9dd83703510e9804d813a9cac32","lessThan":"39e88f28fb32bf02bd4b525c24c842c9cff5663d","status":"affected","versionType":"git"},{"version":"5c2b4b4f9fa5b765b927e361e3d310bcb5773015","status":"affected","versionType":"git"},{"version":"5.9.14","lessThan":"5.10","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nft_payload.c"],"versions":[{"version":"5.10","status":"affected"},{"version":"0","lessThan":"5.10","status":"unaffected","versionType":"semver"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"5.10.265"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"5.15.216"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.1.183"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.6.151"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.12.103"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.18.44"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"7.1.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"7.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9.14"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/3ee7b3f813b11f28cd6efdf7f24d64b5a7fd4dc7"},{"url":"https://git.kernel.org/stable/c/8720df4504e0ed1781a702f65251bd47b3534d5e"},{"url":"https://git.kernel.org/stable/c/363c3a84a946d53e5e121c9f47c7c2b7d228c46b"},{"url":"https://git.kernel.org/stable/c/b19b5d2e042c294e2cc1c908dc598f9d64015396"},{"url":"https://git.kernel.org/stable/c/a375d8ace807767f29f276b681b6324c74929b1d"},{"url":"https://git.kernel.org/stable/c/16b553c46e347bc9de9946c4960654d5884a86de"},{"url":"https://git.kernel.org/stable/c/630295d5bba1d0e0f494cc459452eb0a0058c545"},{"url":"https://git.kernel.org/stable/c/39e88f28fb32bf02bd4b525c24c842c9cff5663d"}],"title":"netfilter: nft_payload: fix mask build for partial field offload","x_generator":{"engine":"bippy-1.2.0"}}}}