CVE-2026-72436

Received Received - Intake

Linux Kernel Netfilter IPSet Race Condition Fix

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types Sashiko pointed out that there are a few lockless RCU readers using test_bit() which is a relaxed atomic operation and provides no memory barrier guarantees. Use test_bit_acquire() instead where the operation may run parallel with add/del/gc, i.e. is not one from the next cases - protected by region lock - in a set destroy phase - in a new/temporary set creation phase

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72436

EUVD

EUVD-2026-59335

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	netfilter_ipset	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's netfilter IPset component. It involves lockless RCU readers using test_bit(), which is an atomic operation without memory barrier guarantees. This can lead to race conditions when running parallel with add/del/gc operations in hash types.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfilter ipset module and requires kernel code inspection. There are no direct commands to detect it as it involves improper use of test_bit() in RCU readers. Check if your kernel version includes the fix by examining the source code for ipset hash types.

Impact Analysis

The vulnerability may cause race conditions in IPset operations, potentially leading to incorrect set states, data corruption, or unexpected behavior in network filtering. Systems relying on IPset for firewall rules could experience instability or security bypasses.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel issue related to memory barriers in RCU readers. No evidence suggests it affects data protection or privacy requirements.

Mitigation Strategies

Update your Linux kernel to a version that includes the fix for this vulnerability. Monitor kernel security advisories and apply patches promptly. If immediate patching is not possible, restrict access to netfilter ipset functionality until the update is applied.

Hi! I’m here to help you understand CVE-2026-72436. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70