Skip to main content

Linux Kernel EUVDEUVD-2026-59629

| CVE-2026-74564 HIGH
2026-08-15 Linux GHSA-mhj7-jjgw-7gmc
Information Disclosure Linux Suse
7.1
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
5.1 MEDIUM

Configuring netfilter rules requires CAP_NET_ADMIN (PR:H in typical contexts); primary impact is uninitialized kernel memory read (C:H); integrity impact is limited to potential rate-limit miscalculation (I:L), not arbitrary write.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
4.4 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 12:30 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.1 (HIGH)
Patch available
Aug 15, 2026 - 13:04 EUVD
CVE Published
Aug 15, 2026 - 12:28 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 12:28 cve.org
HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH

The XT_HASHLIMIT_RATE_MATCH flag mode changes the semantics of the dsthash_ent structure which represents an entry in the hashtable. There is a union area which uses a different layout to express the rate match mode.

Update .checkentry path to validate the XT_HASHLIMIT_RATE_MATCH mode flag is requested by two or more different rules that refer to the same hashtable. Otherwise, uninitialized access to the burst field in the union is possible.

Reject the use of the XT_HASHLIMIT_RATE_MATCH mode flag if set on by revision less than 3 too.

AnalysisAI

Uninitialized memory access in the Linux kernel's netfilter xt_hashlimit module allows local users with netfilter rule configuration privileges to read uninitialized kernel memory and potentially corrupt rate-limiting state. The flaw exists in the .checkentry validation path, which failed to detect when XT_HASHLIMIT_RATE_MATCH mode is applied across multiple rules sharing the same hashtable, leaving the burst field in the dsthash_ent union uninitialized. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain CAP_NET_ADMIN capability
Delivery
Configure shared xt_hashlimit hashtable name
Exploit
Load conflicting RATE_MATCH iptables rule
Execution
Trigger uninitialized burst field access
Persist
Read uninitialized kernel memory
Impact
Extract kernel pointers or sensitive data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to hold CAP_NET_ADMIN capability, which on a default Linux system is restricted to the root user. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD-assigned CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N yields a score of 7.1, reflecting a local, low-complexity path with high confidentiality and integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker holding CAP_NET_ADMIN - such as a privileged container process or a local user with delegated netfilter access - loads two iptables rules that reference the same xt_hashlimit hashtable name, enabling XT_HASHLIMIT_RATE_MATCH on one rule but not the other. The uninitialized burst field in the shared dsthash_ent union is then accessed during packet processing, leaking uninitialized kernel memory values that could include kernel pointers suitable for bypassing KASLR in a follow-on privilege escalation chain. …
Remediation The primary fix is upgrading to a patched kernel version: 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6, all of which include the corrected .checkentry validation logic. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Inventory Linux systems with netfilter modules enabled and assess which have exposure to users holding netfilter configuration privileges. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-59629 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy