Linux Kernel CVE-2026-46101

The vulnerability resides in the Linux kernel's netfilter subsystem, specifically the nft_bitwise expression handler (net/netfilter/nft_bitwise.c), which implements bitwise left and right shift operations for nftables packet-matching rules. When computing carry propagation across adjacent 32-bit words, the code calculates BITS_PER_TYPE(u32) - shift; with a zero shift operand, this yields a 32-bit right or left shift of a uint32_t value. Per the C standard, shifting a value by an amount equal to or greater than the width of the type is undefined behavior - the compiler may silently produce incorrect values or trigger an oops/panic. The fix adds a validation gate during control-plane initialization (before rules reach the packet path) to reject zero shift operands alongside the pre-existing rejection of values >= 32. The vulnerability was introduced at commit 567d746b55bc66d3800c9ae91d50f0c5deb2fd93 (present since Linux 5.6) and is confirmed across CPE cpe:2.3:o:linux:linux_kernel across multiple stable branches. No CWE is formally assigned, but the root cause maps conceptually to CWE-1335 (Incorrect Bitwise Shift of Integer) or CWE-758 (Reliance on Undefined, Unspecified, or Implementation-Defined Behavior).