Linux Kernel EUVD-2026-59219

The vulnerable code is in net/netfilter/nft_lookup.c, the generic set-lookup expression used by nftables rules of the form 'meta ... @set' and its negation '!= @set'. Interval sets (typically backed by nft_set_rbtree) use a synthetic catchall element to represent the open-ended default range. nft_lookup_eval() first performs a direct set lookup, combines the outcome with priv->invert to derive the boolean 'found', and only afterward substitutes the catchall element into 'ext'. Because 'found' is never recomputed after that substitution, the inversion (NFT_LOOKUP_F_INV) is applied to the pre-catchall state, so the rule matches when it should not or skips when it should match. The fix reorders the logic to fold the catchall result into 'ext' before evaluating 'found', mirroring the correct ordering already present in nft_objref_map_eval(). No CWE was assigned, but the root cause is a logic/ordering defect in a security decision path - an incorrect-comparison / stale-state class of bug rather than memory corruption. The CPE data identifies the affected product only generically as cpe:2.3:a:linux:linux, i.e. the mainline kernel.