Linux Kernel EUVD-2026-38724

The vulnerability resides in the Linux kernel's netfilter ipset subsystem, which implements efficient packet classification via hash-based IP sets. Four hash set variants - hash:ip,mark, hash:ip,port, hash:ip,port,ip, and hash:ip,port,net - support IPv4 address range enumeration using a 32-bit unsigned iterator. The root cause, classified as CWE-835 (Loop with Unreachable Exit Condition), is that the iterator increment occurs before the boundary check is evaluated, allowing the value to overflow or advance beyond the upper bound of the requested range. When the kernel's internal retry mechanism re-enters the loop, it uses the now-invalid iterator state as a starting position, causing iteration to proceed from an unintended address. CPE cpe:2.3:a:linux:linux:* encompasses the upstream kernel tree; the flaw was introduced at commit 48596a8ddc46f96afb6a2cd72787cb15d6bb01fc (Linux 4.14 era) and persists across multiple stable branches until their respective fix commits.