CVE-2026-74579
Received Received - Intake

Linux Kernel Netfilter Payload Mask Offload Vulnerability

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_payload: fix mask build for partial field offload nft_payload_offload_mask() builds the offload match mask for a payload expression that covers only part of a header field. For a partial IPv6 address match (field_len = 16, priv_len = 1) that shift is 1 << 120, which is undefined on the 32-bit int operand. It also trims only one word, so the remaining words stay 0xffffffff (and when priv_len is a multiple of 4 the trim is skipped entirely), leaving the mask covering more bytes than the rule matches. UBSAN: shift-out-of-bounds in net/netfilter/nft_payload.c:278:20 shift exponent 120 is too large for 32-bit type 'int' ... The match is byte-granular and struct nft_data is zero-initialised, so the correct mask is simply the first priv_len bytes set to 0xff. Set those bytes directly and drop the word/shift trimming; this removes the undefined shift and no longer over-masks the trailing bytes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-74579
EUVD
EUVD-2026-60050

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect mask building in the nft_payload_offload_mask function. It occurs when handling partial IPv6 address matches, leading to undefined behavior due to excessive bit shifting. The issue causes the mask to cover more bytes than intended, potentially allowing unintended data to match firewall rules.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfilter nft_payload component and does not have direct network or system detection commands. It is detected through kernel logs when UBSAN (Undefined Behavior Sanitizer) triggers a shift-out-of-bounds error in nft_payload.c. Check kernel logs for messages like 'shift-out-of-bounds in net/netfilter/nft_payload.c:278:20'.

Impact Analysis

This vulnerability could allow attackers to bypass network security rules by crafting packets that match firewall rules incorrectly. This might lead to unauthorized access or data exfiltration. Systems using affected Linux kernel versions with nftables could be exposed to such attacks.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-74579. This vulnerability is resolved in kernel versions where the nft_payload.c file has been updated to avoid the undefined shift and over-masking issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74579. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart