vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-72350

netfilter: xt_u32: reject invalid shift counts

HIGH
7.8
CVSS Score
Published: August 15, 2026 at 05:55 AM UTC
Updated: October 16, 2026 at 07:17 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.8
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_u32: reject invalid shift counts u32_match_it() executes rule-supplied shift operands on a 32-bit value. A malformed u32 rule can provide a shift count of 32 or more, triggering an undefined shift out-of-bounds during packet evaluation. Validate XT_U32_LEFTSH and XT_U32_RIGHTSH operands in u32_mt_checkentry() and reject malformed rules before they reach the packet path.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
90%
1b50b8a371e90a5e110f466e4ac02cf6b5f681de2.6.23
Vendor states this is fixed in 00d034fe8230dfc5832fe011ff2d81c1a2cc7a29 (fixed)
Vendor states this is fixed in 0a8b7a6d763775709c601f584e709ae48bcc000a (fixed)
Vendor states this is fixed in 64cdf7d30ac18e43df6c48004435febb965809a8 (fixed)
Vendor states this is fixed in 728f479dc0447ae7eaef87926ff49142e415a811 (fixed)
Vendor states this is fixed in a597a722fb71a534138c20359b655726622b5f17 (fixed)
Vendor states this is fixed in b33b44250d57ab0e5a1e2571b5285fb0d0a7f382 (fixed)
Vendor states this is fixed in ca7c92d9701249e6daf132087756a88cbf2bb2a3 (fixed)
Vendor states this is fixed in cce42014415cecd98aa49b3950e7b02ee7c81268 (fixed)
Vendor states this is fixed in 2.6.23 (unaffected)
Vendor states this is fixed in 5.10.261 (unaffected)
Vendor states this is fixed in 5.15.212 (unaffected)
Vendor states this is fixed in 6.1.178 (unaffected)
Vendor states this is fixed in 6.12.97 (unaffected)
Vendor states this is fixed in 6.18.40 (unaffected)
Vendor states this is fixed in 6.6.145 (unaffected)
Vendor states this is fixed in 7.1.5 (unaffected)
Vendor states this is fixed in 7.2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (8)

Source: cverecord
https://git.kernel.org/stable/c/ca7c92d9701249e6daf132087756a88cbf2bb2a3
Source: cverecord
https://git.kernel.org/stable/c/b33b44250d57ab0e5a1e2571b5285fb0d0a7f382
Source: cverecord
https://git.kernel.org/stable/c/728f479dc0447ae7eaef87926ff49142e415a811
Source: cverecord
https://git.kernel.org/stable/c/0a8b7a6d763775709c601f584e709ae48bcc000a
Source: cverecord
https://git.kernel.org/stable/c/cce42014415cecd98aa49b3950e7b02ee7c81268
Source: cverecord
https://git.kernel.org/stable/c/a597a722fb71a534138c20359b655726622b5f17
Source: cverecord
https://git.kernel.org/stable/c/00d034fe8230dfc5832fe011ff2d81c1a2cc7a29
Source: cverecord
https://git.kernel.org/stable/c/64cdf7d30ac18e43df6c48004435febb965809a8

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card