EUVD-2026-45579
GHSA-hwcj-9qvc-gc7f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain CAP_NET_ADMIN (possibly via user namespace)
-
ExploitLoad nftables rule with same shift src/dst register
-
ExecutionTrigger incorrect carry/dst corruption in shift loop
-
ImpactCorrupt kernel register state causing DoS
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Calculation correctness
|
| Exploitation Conditions | Requires local ability to install nftables rules - specifically CAP_NET_ADMIN in the relevant network namespace, which on many distributions is reachable by an unprivileged user through an unprivileged user namespace. The attacker must craft a bitwise lshift or rshift operation in which the source and destination registers point to the same memory location, triggering the carry miscalculation across 32-bit words. LIMITING FACTORS: no remote vector (AV:L), requires privilege to program the packet-filtering control plane (PR:L), no user interaction, and systems that disable unprivileged user namespaces or restrict CAP_NET_ADMIN substantially shrink the attack surface. Impact is availability only (A:H) - no confidentiality or integrity compromise per the vector. |
| Impact | This is a genuinely low-to-moderate operational risk despite the memory-corruption nature of the bug. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 5.5) tells a consistent story: exploitation is LOCAL (AV:L), requires some privilege (PR:L - in practice CAP_NET_ADMIN, obtainable by an unprivileged user inside a user namespace on many distros), and yields only availability impact (A:H) with no confidentiality or integrity loss (C:N/I:N). These signals do NOT indicate a remotely exploitable, mass-exploitation threat. EPSS reinforces this: 0.17% probability at the 7th percentile - very low predicted exploitation. The flaw is NOT in CISA KEV, and no weaponized public exploit is listed (POC not flagged YES), so there is no evidence of active exploitation. CONFLICT TO NOTE: the input Tags include 'Information Disclosure', but the CVSS vector sets C:N (no confidentiality impact) and CWE-682 (Incorrect Calculation) with A:H describes data/register corruption, not disclosure - the tag appears mislabeled and should not drive triage. Bottom line: a real correctness bug worth patching via normal kernel update cycles, but not an emergency; priority is driven by local privilege boundaries (notably user-namespace exposure) rather than by exploitation likelihood. |
| Exploit ScenarioDerived | A local user who can program nftables rules (CAP_NET_ADMIN, potentially via an unprivileged user namespace) loads a bitwise left/right-shift rule whose source and destination registers are identical, causing the carry to be computed from already-overwritten data and corrupting register contents. The advisory includes reproducer nftables bytecode demonstrating the miscalculation, but no weaponized public exploit is listed and the realistic outcome is kernel-side corruption leading to denial of service rather than code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Memory corruption in the Linux kernel's nf_tables packet-filtering subsystem (netfilter) lets a local attacker holding CAP_NET_ADMIN - an ability reachable by unprivileged users on distributions that permit unprivileged user namespaces - mangle kernel register state by supplying a bitwise left- or right-shift rule whose source and destination registers alias the same memory. The carry calculation for the multi-word shift reads back the already-overwritten destination instead of the original source, producing an incorrect result that the kernel then acts on; per the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H vector, impact is limited to availability (crash or denial of service), with no confidentiality or integrity consequence, and exploitation requires the attacker to craft and install a malicious nftables ruleset, so unprivileged user namespaces or CAP_NET_ADMIN restrictions shrink the exposure considerably. This is a low-to-moderate operational risk: EPSS is only 0.17% (7th percentile), no public exploit code has been identified at time of analysis, and the flaw is not confirmed actively exploited (no CISA KEV listing), but vendor patches are already available.
RemediationAI
Vendor-released patch: upgrade to Linux 6.6.143, 6.18.35, 7.0.12 or 7.1, or install the distribution kernel carrying the equivalent stable backport from the four git.kernel.org commits listed in the references; Ubuntu users should apply USN-8593-1 (https://ubuntu.com/security/notices/USN-8593-1). Because the fix changes control-plane behaviour and now rejects partially overlapping src/dst operands for all bitwise operations including byteorder, environments with hand-written or generated rulesets that rely on such overlap should re-validate and re-deploy their rulesets after the upgrade to avoid load failures. Where patching must be deferred, the most effective compensating control is to remove the local attack prerequisite rather than to filter traffic: disable unprivileged user namespaces (sysctl kernel.unprivileged_userns_clone=0, or user.max_user_namespaces=0 on kernels without that knob) so that non-root users cannot obtain CAP_NET_ADMIN in a new namespace, accepting that this breaks rootless containers, unprivileged Podman/buildah workloads and similar tools; alternatively drop CAP_NET_ADMIN from untrusted workloads or run them in namespaces where nftables rule installation is not permitted, with the trade-off that legitimate network administration within those namespaces stops working. Restricting who may call the nftables netlink API and monitoring for unexpected ruleset loads reduce the window further, but note that EPSS is only 0.17% and no public exploit code has been identified at time of analysis, so these measures can be applied proportionally to the exposure of multi-tenant or container-hosting hosts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the nftables bytecode virtual machine inside the Linux kernel's netfilter subsystem (cpe:2.3:a:linux:linux), which evaluates rulesets compiled from the userspace nft tool. The bitwise expression implements lshift and rshift by iterating over 32-bit words: it writes the shifted word to the destination register and then immediately reads the source register to compute the carry into the next word. Because the control plane permits src and dst to be the same register, the second read observes the freshly written destination rather than the original source, so the carry - and therefore the whole shifted result - is wrong. This is a classic CWE-682 (Incorrect Calculation) defect in which a destructive write is not separated from a subsequent read of the same buffer. The upstream fix caches the original source word in a temporary local variable before the destination write and uses that cached value for the carry, and additionally rejects partially overlapping src/dst operands at the control plane for every operation type, including byteorder, so that malformed rulesets are refused at rule-insertion time rather than producing silent corruption at packet-processing time. The fix was validated with the bytecode example in the description, where a 64-bit immediate shifted left by 0x08000000 must compare equal to the correctly carried result.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Requires local privilege to program nftables (CAP_NET_ADMIN) so AV:L/PR:L; deterministic trigger gives AC:L; corruption yields DoS only, hence C:N/I:N/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: fix dst corruption in same register operation
For lshift and rshift, the shift operations are performed in a loop over 32-bit words. The loop calculates the shifted value and write it to dst, and then immediately reads from src to calculate the carry for the next iteration. Because src and dst could point to the same memory location, the carry is incorrectly calculated using the newly modified dst value instead of the original src value.
Adding a temporary local variable to cache the original value before writing to dst and using it for the carry calculation solves the problem. In addition, partial overlap is rejected from control plane for all kind of operations including byteorder. This was tested with the following bytecode:
table test_table ip flags 0 use 1 handle 1 ip test_table test_chain use 3 type filter hook input prio 0 policy accept packets 0 bytes 0 flags 1 ip test_table test_chain 2 [ immediate reg 1 0x44332211 0x88776655 ] [ bitwise reg 1 = ( reg 1 << 0x08000000 ) ] [ cmp eq reg 1 0x66443322 0x00887766 ] [ counter pkts 0 bytes 0 ] ip test_table test_chain 4 3 [ immediate reg 1 0x44332211 0x88776655 ] [ bitwise reg 1 = ( reg 1 << 0x08000000 ) ] [ cmp eq reg 1 0x55443322 0x00887766 ] [ counter pkts 21794 bytes 1917798 ]
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB