Linux Kernel EUVD-2026-59249

The affected component is the netfilter kernel module xt_u32 (cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*), which enables iptables/nftables rules to match arbitrary 32-bit values extracted from packet data using sequences of shift and mask operations. The root cause is undefined behavior (UB) in the C language specification: applying a left or right bit-shift by a count greater than or equal to the operand's bit width (here, 32 bits on a uint32_t) is explicitly undefined, meaning compilers and processors are free to produce any result, including memory corruption. The function u32_match_it() trusted rule-supplied XT_U32_LEFTSH and XT_U32_RIGHTSH operands without range validation. The fix, applied in u32_mt_checkentry() - the kernel hook that validates rules at load time - rejects any shift count outside [0, 31] before the rule reaches the packet-processing path. Although no formal CWE is assigned, the behavior maps to CWE-682 (Incorrect Calculation) with memory-corruption consequences consistent with the 'Buffer Overflow' tag applied by the reporting source.