CVE-2026-72320

Received Received - Intake

nft_lookup Catchall Element Handling Flaw in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_lookup: fix catchall element handling with inverted lookups nft_lookup_eval() decides whether a lookup matched (`found`) from the direct set lookup and priv->invert before falling back to the catchall element used by interval sets (e.g. nft_set_rbtree) for the open-ended default range. Since `found` is never recomputed after `ext` is replaced by the catchall lookup, inverted lookups (NFT_LOOKUP_F_INV, "!= @set") can wrongly match or wrongly skip the catchall element, producing the wrong verdict. Fold the catchall lookup into `ext` before computing `found`, matching the order already used by nft_objref_map_eval().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72320

EUVD

EUVD-2026-59219

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel affects netfilter's nft_lookup functionality. It involves incorrect handling of catchall elements when using inverted lookups (e.g., != @set). The issue occurs because the lookup decision is made before considering the catchall element, leading to wrong verdicts in packet filtering.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfilter subsystem, particularly in the nft_lookup module. Detection requires checking the kernel version and verifying if the affected code path is present. Use uname -a to check the kernel version and grep for nft_lookup in loaded kernel modules. If vulnerable, update the kernel immediately.

Impact Analysis

This flaw could allow network traffic to bypass intended firewall rules or packet filtering, potentially enabling unauthorized access or data exfiltration. Systems relying on nftables for network security may enforce incorrect policies.

Compliance Impact

This vulnerability affects compliance with standards like GDPR and HIPAA by potentially enabling unauthorized network access or data exfiltration due to incorrect packet filtering in the Linux kernel's netfilter subsystem. Misconfigured firewall rules could lead to violations of data protection requirements.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-72320. Monitor official Linux kernel security advisories for patches and apply them promptly.

Hi! I’m here to help you understand CVE-2026-72320. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70