CVE-2026-72350

netfilter: xt_u32: reject invalid shift counts

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_u32: reject invalid shift counts

u32_match_it() executes rule-supplied shift operands on a 32-bit value. A malformed u32 rule can provide a shift count of 32 or more, triggering an undefined shift out-of-bounds during packet evaluation.

Validate XT_U32_LEFTSH and XT_U32_RIGHTSH operands in u32_mt_checkentry() and reject malformed rules before they reach the packet path.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1b50b8a371e90a5e110f466e4ac02cf6b5f681de to before ca7c92d9701249e6daf132087756a88cbf2bb2a3Affected 1b50b8a371e90a5e110f466e4ac02cf6b5f681de to before b33b44250d57ab0e5a1e2571b5285fb0d0a7f382Affected 1b50b8a371e90a5e110f466e4ac02cf6b5f681de to before 728f479dc0447ae7eaef87926ff49142e415a811Affected 1b50b8a371e90a5e110f466e4ac02cf6b5f681de to before 0a8b7a6d763775709c601f584e709ae48bcc000aAffected 1b50b8a371e90a5e110f466e4ac02cf6b5f681de to before cce42014415cecd98aa49b3950e7b02ee7c81268Affected 1b50b8a371e90a5e110f466e4ac02cf6b5f681de to before a597a722fb71a534138c20359b655726622b5f17Affected 1b50b8a371e90a5e110f466e4ac02cf6b5f681de to before 00d034fe8230dfc5832fe011ff2d81c1a2cc7a29Affected 1b50b8a371e90a5e110f466e4ac02cf6b5f681de to before 64cdf7d30ac18e43df6c48004435febb965809a8Affected
LinuxLinux	2.6.23Affected before 2.6.23Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

1b50b8a371e90a5e110f466e4ac02cf6b5f681de to before ca7c92d9701249e6daf132087756a88cbf2bb2a3Affected
1b50b8a371e90a5e110f466e4ac02cf6b5f681de to before b33b44250d57ab0e5a1e2571b5285fb0d0a7f382Affected
1b50b8a371e90a5e110f466e4ac02cf6b5f681de to before 728f479dc0447ae7eaef87926ff49142e415a811Affected
1b50b8a371e90a5e110f466e4ac02cf6b5f681de to before 0a8b7a6d763775709c601f584e709ae48bcc000aAffected
1b50b8a371e90a5e110f466e4ac02cf6b5f681de to before cce42014415cecd98aa49b3950e7b02ee7c81268Affected
1b50b8a371e90a5e110f466e4ac02cf6b5f681de to before a597a722fb71a534138c20359b655726622b5f17Affected
1b50b8a371e90a5e110f466e4ac02cf6b5f681de to before 00d034fe8230dfc5832fe011ff2d81c1a2cc7a29Affected
1b50b8a371e90a5e110f466e4ac02cf6b5f681de to before 64cdf7d30ac18e43df6c48004435febb965809a8Affected

LinuxLinux

2.6.23Affected
before 2.6.23Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.