Linux Kernel CVE-2026-72320

Exploitation requires the target host to run an affected kernel with an nftables ruleset that performs an inverted lookup (NFT_LOOKUP_F_INV, i.e. '!= @set') against an interval set that relies on a catchall element for its open-ended default range (typically an nft_set_rbtree set). Without such a rule present, the buggy branch is never taken. What limits exploitation: the flaw is not attacker-configurable - it depends entirely on the defender's ruleset shape - so hosts using only positive matches or non-interval sets are unaffected; the attacker must also know or infer which traffic attributes map into the catchall range to steer the wrong verdict. There is no authentication requirement in the packet-processing path (PR:N per the published vector), but the practical precondition (specific ruleset configuration) is a significant limiting factor beyond the raw CVSS score.

The signals conflict and warrant scrutiny. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N, base 9.1) portrays this as a trivially exploitable remote critical, yet the description makes clear the defect only manifests when a ruleset actually uses inverted lookups against interval/catchall sets - a real but conditional deployment prerequisite that argues for higher attack complexity than AC:L implies. The 'Information Disclosure' tag also sits awkwardly against the mechanism, which is fundamentally a firewall-verdict error (bypass) rather than a memory read; the true impact is a security-control bypass whose confidentiality consequence is indirect. EPSS is low (0.21%, 11th percentile) and the CVE is not on CISA KEV, consistent with no known active exploitation and no public PoC. The practical takeaway: this is a legitimate correctness-of-security-policy bug that any operator relying on nftables negated set matches - even a mid-sized municipal IT team in gniezno running an nftables edge firewall should patch it on their normal kernel-update cadence - but it is not the drop-everything emergency the 9.1 alone suggests, because exploitation depends on a specific ruleset shape rather than firing against every default install. Where the CVSS and description disagree (network-easy vs. config-dependent), trust the description and treat AC as elevated pending vendor clarification.

An operator deploys an nftables firewall whose policy blocks or admits traffic using an inverted interval-set match (e.g. accept if source is NOT in @blocklist). A remote attacker sends packets whose attributes fall into the set's open-ended catchall range; because the inverted verdict is computed against stale state, the packet is wrongly admitted (bypassing the block) or wrongly dropped. No exploit code is publicly known, and the technique requires only ordinary network packets once the vulnerable ruleset exists.