Linux Kernel Netfilter Set RBTree Partial Overlap

Publication date: 2026-05-27

Last updated on: 2026-06-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets Userspace provides an optimized representation in case intervals are adjacent, where the end element is omitted. The existing partial overlap detection logic skips anonymous set checks on start elements for this reason. However, it is possible to add intervals that overlap to this anonymous where two start elements with the same, eg. A-B, A-C where C < B. start end A B start end A C Restore the check on overlapping start elements to report an overlap.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-25

Generated

2026-07-06

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-45873

EUVD

EUVD-2026-32339

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.2
linux	linux_kernel	6.2
linux	linux_kernel	6.2
linux	linux_kernel	6.2
linux	linux_kernel	From 5.4.262 (inc) to 5.5 (exc)
linux	linux_kernel	From 4.19.316 (inc) to 4.20 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.14 (exc)
linux	linux_kernel	From 6.19 (inc) to 6.19.4 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.75 (exc)
linux	linux_kernel	From 5.10.166 (inc) to 5.10.252 (exc)
linux	linux_kernel	From 5.15.91 (inc) to 5.15.202 (exc)
linux	linux_kernel	From 6.1.9 (inc) to 6.1.165 (exc)
linux	linux_kernel	From 6.2.1 (inc) to 6.6.128 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Impact Analysis

This vulnerability in the Linux kernel's netfilter nft_set_rbtree component involves improper detection of partial overlaps in anonymous sets. Because the existing logic skips certain checks, it is possible to add overlapping intervals that should be disallowed. This could potentially lead to incorrect behavior in the kernel's handling of network filtering rules, which might affect system stability or security.

Executive Summary

This vulnerability exists in the Linux kernel's netfilter component, specifically in the nft_set_rbtree functionality. It involves the detection of partial overlaps in anonymous sets, which are optimized interval representations where adjacent intervals omit the end element. The existing logic for detecting partial overlaps incorrectly skips checks on start elements, allowing intervals that overlap to be added improperly. For example, intervals like A-B and A-C where C is less than B can overlap without being detected. The fix restores the check on overlapping start elements to correctly report such overlaps.

Hi! I’m here to help you understand CVE-2026-45873. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70