EUVD-2026-60050
GHSA-h46j-5f2w-jjq4
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
AC:H because specific nftables offload configuration with partial IPv6 field match is required; PR:L reflects CAP_NET_ADMIN obtainable via user namespaces; no confidentiality impact applies.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_payload: fix mask build for partial field offload
nft_payload_offload_mask() builds the offload match mask for a payload expression that covers only part of a header field. For a partial IPv6 address match (field_len = 16, priv_len = 1) that shift is 1 << 120, which is undefined on the 32-bit int operand. It also trims only one word, so the remaining words stay 0xffffffff (and when priv_len is a multiple of 4 the trim is skipped entirely), leaving the mask covering more bytes than the rule matches.
UBSAN: shift-out-of-bounds in net/netfilter/nft_payload.c:278:20 shift exponent 120 is too large for 32-bit type 'int' ...
The match is byte-granular and struct nft_data is zero-initialised, so the correct mask is simply the first priv_len bytes set to 0xff. Set those bytes directly and drop the word/shift trimming; this removes the undefined shift and no longer over-masks the trailing bytes.
AnalysisAI
Netfilter's nft_payload offload mask builder in the Linux kernel performs an undefined-behavior shift (1 << 120 on a 32-bit int) when constructing hardware-offload match masks for partial IPv6 address fields, and separately over-masks trailing bytes when priv_len is a multiple of four. Systems running affected kernel versions that use nftables hardware offload rules with partial IPv6 address matches may experience firewall rule bypass (I:H) or kernel instability triggered by UBSAN (A:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local system access and CAP_NET_ADMIN capability, which on kernels with user namespace support (CONFIG_USER_NS=y, the default on most distributions) can be obtained by unprivileged users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H scores 7.1 (High), reflecting local exploitation with low-privilege access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with CAP_NET_ADMIN (achievable via unprivileged user namespaces on many Linux distributions) loads an nftables ruleset that uses payload offload with a partial IPv6 address match on an offload-capable interface. The malformed mask causes the hardware to silently pass packets that should have been dropped per policy, effectively bypassing the intended firewall rule. … |
| Remediation | Upgrade to a patched Linux kernel version: 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2, as confirmed by EUVD. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit inventory systems to identify all Linux instances running nftables with hardware offload enabled that enforce IPv6 traffic filtering rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today