CVE-2026-72320

netfilter: nft_lookup: fix catchall element handling with inverted lookups

State: Published
Severity: 9.1 Critical
Published: Aug 15, 2026
Updated: Oct 30, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_lookup: fix catchall element handling with inverted lookups

nft_lookup_eval() decides whether a lookup matched (`found`) from the direct set lookup and priv->invert before falling back to the catchall element used by interval sets (e.g. nft_set_rbtree) for the open-ended default range. Since `found` is never recomputed after `ext` is replaced by the catchall lookup, inverted lookups (NFT_LOOKUP_F_INV, "!= @set") can wrongly match or wrongly skip the catchall element, producing the wrong verdict. Fold the catchall lookup into `ext` before computing `found`, matching the order already used by nft_objref_map_eval().

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	aaa31047a6d25da0fa101da1ed544e1247949b40 to before 87ff022a58788ff4a25cf2c609b9abae418c9323Affected aaa31047a6d25da0fa101da1ed544e1247949b40 to before 65d35cb555f40529a9edc6bf4beaa3bee917f015Affected aaa31047a6d25da0fa101da1ed544e1247949b40 to before 0ab8880865f9678eb6174e72c1fc4712e44c745cAffected aaa31047a6d25da0fa101da1ed544e1247949b40 to before 238c612357b5a25f03eacf356f95034f8551f218Affected aaa31047a6d25da0fa101da1ed544e1247949b40 to before ef0c7d4b04a0e6ad175323c24bc84e11470dd79dAffected aaa31047a6d25da0fa101da1ed544e1247949b40 to before e6107a4c74b54cb33e3bce162a63048ae5a6b198Affected
LinuxLinux	5.13Affected before 5.13Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

aaa31047a6d25da0fa101da1ed544e1247949b40 to before 87ff022a58788ff4a25cf2c609b9abae418c9323Affected
aaa31047a6d25da0fa101da1ed544e1247949b40 to before 65d35cb555f40529a9edc6bf4beaa3bee917f015Affected
aaa31047a6d25da0fa101da1ed544e1247949b40 to before 0ab8880865f9678eb6174e72c1fc4712e44c745cAffected
aaa31047a6d25da0fa101da1ed544e1247949b40 to before 238c612357b5a25f03eacf356f95034f8551f218Affected
aaa31047a6d25da0fa101da1ed544e1247949b40 to before ef0c7d4b04a0e6ad175323c24bc84e11470dd79dAffected
aaa31047a6d25da0fa101da1ed544e1247949b40 to before e6107a4c74b54cb33e3bce162a63048ae5a6b198Affected

LinuxLinux

5.13Affected
before 5.13Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.