Vulnerability-Lookup

GHSA-XM9X-R949-VC7P

Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-17 06:33

Details

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_lookup: fix catchall element handling with inverted lookups

nft_lookup_eval() decides whether a lookup matched (found) from the direct set lookup and priv->invert before falling back to the catchall element used by interval sets (e.g. nft_set_rbtree) for the open-ended default range. Since found is never recomputed after ext is replaced by the catchall lookup, inverted lookups (NFT_LOOKUP_F_INV, "!= @set") can wrongly match or wrongly skip the catchall element, producing the wrong verdict. Fold the catchall lookup into ext before computing found, matching the order already used by nft_objref_map_eval().

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-72320"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T06:22:04Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_lookup: fix catchall element handling with inverted lookups\n\nnft_lookup_eval() decides whether a lookup matched (`found`) from the\ndirect set lookup and priv-\u003einvert before falling back to the\ncatchall element used by interval sets (e.g. nft_set_rbtree) for the\nopen-ended default range. Since `found` is never recomputed after\n`ext` is replaced by the catchall lookup, inverted lookups\n(NFT_LOOKUP_F_INV, \"!= @set\") can wrongly match or wrongly skip the\ncatchall element, producing the wrong verdict. Fold the catchall\nlookup into `ext` before computing `found`, matching the order\nalready used by nft_objref_map_eval().",
  "id": "GHSA-xm9x-r949-vc7p",
  "modified": "2026-08-17T06:33:23Z",
  "published": "2026-08-15T06:32:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72320"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0ab8880865f9678eb6174e72c1fc4712e44c745c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/238c612357b5a25f03eacf356f95034f8551f218"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e6107a4c74b54cb33e3bce162a63048ae5a6b198"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ef0c7d4b04a0e6ad175323c24bc84e11470dd79d"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-72320 (GCVE-0-2026-72320)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:42

Title

netfilter: nft_lookup: fix catchall element handling with inverted lookups

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_lookup: fix catchall element handling with inverted lookups nft_lookup_eval() decides whether a lookup matched (`found`) from the direct set lookup and priv->invert before falling back to the catchall element used by interval sets (e.g. nft_set_rbtree) for the open-ended default range. Since `found` is never recomputed after `ext` is replaced by the catchall lookup, inverted lookups (NFT_LOOKUP_F_INV, "!= @set") can wrongly match or wrongly skip the catchall element, producing the wrong verdict. Fold the catchall lookup into `ext` before computing `found`, matching the order already used by nft_objref_map_eval().

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/0ab8880865f9678eb…
https://git.kernel.org/stable/c/238c612357b5a25f0…
https://git.kernel.org/stable/c/ef0c7d4b04a0e6ad1…
https://git.kernel.org/stable/c/e6107a4c74b54cb33…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: aaa31047a6d25da0fa101da1ed544e1247949b40 , < 0ab8880865f9678eb6174e72c1fc4712e44c745c (git) Affected: aaa31047a6d25da0fa101da1ed544e1247949b40 , < 238c612357b5a25f03eacf356f95034f8551f218 (git) Affected: aaa31047a6d25da0fa101da1ed544e1247949b40 , < ef0c7d4b04a0e6ad175323c24bc84e11470dd79d (git) Affected: aaa31047a6d25da0fa101da1ed544e1247949b40 , < e6107a4c74b54cb33e3bce162a63048ae5a6b198 (git)
Linux	Linux	Affected: 5.13 Unaffected: 0 , < 5.13 (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_lookup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0ab8880865f9678eb6174e72c1fc4712e44c745c",
              "status": "affected",
              "version": "aaa31047a6d25da0fa101da1ed544e1247949b40",
              "versionType": "git"
            },
            {
              "lessThan": "238c612357b5a25f03eacf356f95034f8551f218",
              "status": "affected",
              "version": "aaa31047a6d25da0fa101da1ed544e1247949b40",
              "versionType": "git"
            },
            {
              "lessThan": "ef0c7d4b04a0e6ad175323c24bc84e11470dd79d",
              "status": "affected",
              "version": "aaa31047a6d25da0fa101da1ed544e1247949b40",
              "versionType": "git"
            },
            {
              "lessThan": "e6107a4c74b54cb33e3bce162a63048ae5a6b198",
              "status": "affected",
              "version": "aaa31047a6d25da0fa101da1ed544e1247949b40",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_lookup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_lookup: fix catchall element handling with inverted lookups\n\nnft_lookup_eval() decides whether a lookup matched (`found`) from the\ndirect set lookup and priv-\u003einvert before falling back to the\ncatchall element used by interval sets (e.g. nft_set_rbtree) for the\nopen-ended default range. Since `found` is never recomputed after\n`ext` is replaced by the catchall lookup, inverted lookups\n(NFT_LOOKUP_F_INV, \"!= @set\") can wrongly match or wrongly skip the\ncatchall element, producing the wrong verdict. Fold the catchall\nlookup into `ext` before computing `found`, matching the order\nalready used by nft_objref_map_eval()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - nft_lookup_eval() runs on the netfilter packet datapath via nft_do_chain() for ingress/forward/prerouting hooks, so a remote sender can reach the bug by sending packets evaluated against an affected inverted lookup rule on a catchall interval set.\nAC:L - Once such a ruleset exists, the attacker reliably controls whether the lookup key hits a set element or the catchall by crafting packet fields; no race, memory layout dependency, or other uncontrollable victim state is required.\nPR:N - Exploitation at runtime only requires sending network traffic through the victim\u0027s nftables hooks; although rule installation needs CAP_NET_ADMIN, the remote attacker needs no credentials or local privileges on the target system.\nUI:N - No victim user interaction is needed beyond normal network traffic processing; the kernel automatically evaluates the inverted lookup expression for each matching packet.\nS:U - The impact is incorrect nftables verdicts within the host/kernel network security authority and does not cross VM, container-host, or IOMMU security boundaries.\nC:H - Wrongly matching or skipping the catchall element can bypass intended filtering and expose protected internal services or data that the firewall policy was meant to block from the attacker\u0027s network position.\nI:H - The bug can apply or omit catchall set-element actions and verdicts (accept/drop/jump), allowing unauthorized traffic handling contrary to the administrator\u0027s intended nftables policy.\nA:N - This is a pure logic error that returns incorrect verdicts without memory corruption, kernel oops/panic, hang, or other direct loss of kernel availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:42:46.791Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0ab8880865f9678eb6174e72c1fc4712e44c745c"
        },
        {
          "url": "https://git.kernel.org/stable/c/238c612357b5a25f03eacf356f95034f8551f218"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef0c7d4b04a0e6ad175323c24bc84e11470dd79d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6107a4c74b54cb33e3bce162a63048ae5a6b198"
        }
      ],
      "title": "netfilter: nft_lookup: fix catchall element handling with inverted lookups",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72320",
    "datePublished": "2026-08-15T05:55:32.939Z",
    "dateReserved": "2026-08-09T03:40:39.919Z",
    "dateUpdated": "2026-08-17T05:42:46.791Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-XM9X-R949-VC7P

CVE-2026-72320 (GCVE-0-2026-72320)

Tags

Sightings

Nomenclature