CVE-2026-72350

Received Received - Intake

xt_u32 Module Integer Overflow in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_u32: reject invalid shift counts u32_match_it() executes rule-supplied shift operands on a 32-bit value. A malformed u32 rule can provide a shift count of 32 or more, triggering an undefined shift out-of-bounds during packet evaluation. Validate XT_U32_LEFTSH and XT_U32_RIGHTSH operands in u32_mt_checkentry() and reject malformed rules before they reach the packet path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72350

EUVD

EUVD-2026-59249

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the netfilter subsystem's xt_u32 module. It allows a malformed rule to specify an invalid shift count (32 or more) when processing packets. This causes an undefined out-of-bounds shift operation during packet evaluation, potentially leading to unexpected behavior or crashes.

Detection Guidance

This vulnerability can be detected by checking for malformed u32 rules in netfilter rulesets. Inspect iptables/nftables rules for invalid shift counts in XT_U32_LEFTSH or XT_U32_RIGHTSH operands. Use commands like 'iptables -L -v -n' or 'nft list ruleset' to review rules. Look for rules using the u32 match with shift values >= 32.

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause a denial-of-service (DoS) condition by crashing the system or disrupting network traffic. It may also enable unauthorized access or manipulation of network packet processing if combined with other vulnerabilities.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel issue involving packet filtering that could potentially allow denial-of-service conditions if exploited. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Immediately update the Linux kernel to the patched version. Remove or correct any malformed u32 rules in iptables/nftables configurations. Disable or restrict untrusted users from modifying firewall rules until the system is updated.

Hi! I’m here to help you understand CVE-2026-72350. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70