Skip to main content

Linux Kernel CVE-2026-74579

| EUVDEUVD-2026-60050 HIGH
2026-08-17 Linux GHSA-h46j-5f2w-jjq4
Buffer Overflow Linux
High
Disputed · 7.1 Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain CAP_NET_ADMIN via user namespace
  2. Delivery
    Identify offload-capable NIC on target
  3. Exploit
    Load nftables rule with partial IPv6 payload offload match
  4. Execution
    nft_payload_offload_mask() executes undefined shift (1 << 120)
  5. Persist
    Offload mask covers excess bytes
  6. Impact
    Hardware passes packets violating intended firewall policy

Vulnerability Assessment

Exploitation Conditions

Exploitation requires local system access and CAP_NET_ADMIN capability, which on kernels with user namespace support (CONFIG_USER_NS=y, the default on most distributions) can be obtained by unprivileged users. The vulnerable code path is only reached when: (1) nftables hardware offload is configured (nft add rule with 'offload' keyword), (2) the offloaded rule contains a payload expression matching only a partial IPv6 address field (e.g., matching a subset of bytes within a 16-byte IPv6 address), and (3) a network interface with a driver that supports nftables flow offload is present and active. Systems without offload-capable NICs or that do not use partial IPv6 payload matching in offloaded rulesets are not affected. The requirement for a specific nftables offload configuration with partial IPv6 matching significantly limits the realistic attack surface beyond the raw CVSS score.
Impact

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H scores 7.1 (High), reflecting local exploitation with low-privilege access. In practice, triggering this bug requires CAP_NET_ADMIN to configure nftables rules and the additional condition that a hardware offload-capable NIC is present and a partial IPv6 payload match rule is loaded - this raises real-world attack complexity above AC:L. EPSS of 0.16% at the 5th percentile and absence from CISA KEV are consistent with a maintenance/correctness fix rather than an exploitable attack path. The I:H rating reflects that a malformed offload mask could cause the hardware to match traffic incorrectly, silently bypassing a firewall policy; A:H reflects potential kernel panic from undefined-behavior execution. No confidentiality impact is applicable. The primary risk is to environments relying on nftables hardware offload for IPv6 packet filtering correctness, not general remote compromise. The CVSS vector's AC:L appears optimistic - specific offload configuration is required.
Exploit ScenarioDerived

A local user with CAP_NET_ADMIN (achievable via unprivileged user namespaces on many Linux distributions) loads an nftables ruleset that uses payload offload with a partial IPv6 address match on an offload-capable interface. The malformed mask causes the hardware to silently pass packets that should have been dropped per policy, effectively bypassing the intended firewall rule. In a worst-case path where UBSAN is not compiled in and the undefined shift produces a garbage mask value, the behavior becomes indeterminate and may destabilize the kernel.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 25, 2026

Netfilter's nft_payload offload mask builder in the Linux kernel performs an undefined-behavior shift (1 << 120 on a 32-bit int) when constructing hardware-offload match masks for partial IPv6 address fields, and separately over-masks trailing bytes when priv_len is a multiple of four. Systems running affected kernel versions that use nftables hardware offload rules with partial IPv6 address matches may experience firewall rule bypass (I:H) or kernel instability triggered by UBSAN (A:H). No public exploit is identified at time of analysis, and EPSS sits at 0.16% (5th percentile), consistent with a kernel correctness/stability bug rather than an actively targeted security issue. Patches are available across all active stable branches.

RemediationAI

Upgrade to a patched Linux kernel version: 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2, as confirmed by EUVD. Upstream stable patches are available at git.kernel.org via commits b19b5d2e042c294e2cc1c908dc598f9d64015396, a375d8ace807767f29f276b681b6324c74929b1d, 16b553c46e347bc9de9946c4960654d5884a86de, 630295d5bba1d0e0f494cc459452eb0a0058c545, and 39e88f28fb32bf02bd4b525c24c842c9cff5663d. Distribution-specific backports should be applied as released by upstream maintainers. Where immediate patching is not possible, disable nftables hardware offload by avoiding the 'offload' flag in nft ruleset configuration for any rule matching partial IPv6 address fields - this prevents the affected code path from executing entirely, with the trade-off of losing hardware-accelerated packet matching performance. NVD advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-74579.

Affected VersionsENISA

Linux 5c2b4b4f9fa5b765b927e361e3d310bcb5773015
Linux a5d45bc0dc50f9dd83703510e9804d813a9cac32 <a375d8ace807767f29f276b681b6324c74929b1d
Linux a5d45bc0dc50f9dd83703510e9804d813a9cac32 <39e88f28fb32bf02bd4b525c24c842c9cff5663d
Linux patch: 6.6.151
Linux patch: 6.12.103
Linux a5d45bc0dc50f9dd83703510e9804d813a9cac32 <b19b5d2e042c294e2cc1c908dc598f9d64015396
Linux patch: 7.1.8
Linux 5.9.14 <5.10
Linux patch: 7.2
Linux a5d45bc0dc50f9dd83703510e9804d813a9cac32 <16b553c46e347bc9de9946c4960654d5884a86de
Linux patch: 0
Linux a5d45bc0dc50f9dd83703510e9804d813a9cac32 <630295d5bba1d0e0f494cc459452eb0a0058c545
Linux patch: 6.18.44
Linux 5.10

Affected Packages

euvd linux fix: 5.10

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw resides in nft_payload_offload_mask() at net/netfilter/nft_payload.c:278 within the Linux kernel netfilter subsystem. The function constructs a byte-mask for hardware-offload matching of payload expressions that cover only a portion of a header field. For a partial IPv6 address match where field_len=16 and priv_len=1, the original code computed 1 << 120 on a 32-bit int operand - undefined behavior per the C standard and caught by UBSAN at runtime. A secondary bug left trailing 32-bit words in the mask at 0xffffffff when priv_len is word-aligned, causing the hardware offload to match more bytes than the nftables rule specifies. The root cause class aligns with CWE-190 (Integer Overflow/Wraparound) and CWE-682 (Incorrect Calculation), though no CWE is formally assigned. The fix replaces the word/shift trimming logic with a direct byte-level initialization: set the first priv_len bytes to 0xff over a zero-initialized nft_data struct, which is both well-defined and byte-granularly precise. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY 7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
vuln.today AI 6.3 MEDIUM

AC:H because specific nftables offload configuration with partial IPv6 field match is required; PR:L reflects CAP_NET_ADMIN obtainable via user namespaces; no confidentiality impact applies.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Red Hat 5.5 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Aug 25, 2026 - 06:22 NVD
7.1 (HIGH)
Patch available
Aug 17, 2026 - 06:01 EUVD
CVE Published
Aug 17, 2026 - 05:28 cve.org
HIGH 7.1
CVE Published
Aug 17, 2026 - 05:28 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_payload: fix mask build for partial field offload

nft_payload_offload_mask() builds the offload match mask for a payload expression that covers only part of a header field. For a partial IPv6 address match (field_len = 16, priv_len = 1) that shift is 1 << 120, which is undefined on the 32-bit int operand. It also trims only one word, so the remaining words stay 0xffffffff (and when priv_len is a multiple of 4 the trim is skipped entirely), leaving the mask covering more bytes than the rule matches.

UBSAN: shift-out-of-bounds in net/netfilter/nft_payload.c:278:20 shift exponent 120 is too large for 32-bit type 'int' ...

The match is byte-granular and struct nft_data is zero-initialised, so the correct mask is simply the first priv_len bytes set to 0xff. Set those bytes directly and drop the word/shift trimming; this removes the undefined shift and no longer over-masks the trailing bytes.

Executive ViewAI

Why It Matters

A critical defect in the Linux kernel's nftables firewall offload mechanism can allow IPv6 traffic filtering rules to be bypassed on systems using hardware-accelerated packet processing. No public exploit identified at time of analysis, but the vulnerability enables firewall rule circumvention, requiring prompt patching across affected Linux infrastructure to restore perimeter defense integrity.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
Ubiquitous
Linux kernel underlies majority of cloud, server, and embedded infrastructure globally
Social Media
2
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-74579 ADVISORY https://ubuntu.com/security/notices/USN-8876-1 ADVISORY https://ubuntu.com/security/notices/USN-8877-1 ADVISORY https://ubuntu.com/security/notices/USN-8878-1 ADVISORY https://ubuntu.com/security/notices/USN-8879-1 ADVISORY https://vuldb.com/vuln/391206 REF https://git.kernel.org/stable/c/16b553c46e347bc9de9946c4960654d5884a86de REF https://git.kernel.org/stable/c/363c3a84a946d53e5e121c9f47c7c2b7d228c46b REF https://git.kernel.org/stable/c/39e88f28fb32bf02bd4b525c24c842c9cff5663d REF https://git.kernel.org/stable/c/3ee7b3f813b11f28cd6efdf7f24d64b5a7fd4dc7 REF https://git.kernel.org/stable/c/630295d5bba1d0e0f494cc459452eb0a0058c545 REF https://git.kernel.org/stable/c/8720df4504e0ed1781a702f65251bd47b3534d5e REF https://git.kernel.org/stable/c/a375d8ace807767f29f276b681b6324c74929b1d REF https://git.kernel.org/stable/c/b19b5d2e042c294e2cc1c908dc598f9d64015396

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy