Executive brief
A vulnerability was identified in the Linux kernel's netfilter component, which handles network traffic filtering. The issue involves how the system manages 'anonymous sets'—temporary groups of network addresses or ports used for firewall rules. An attacker could potentially bypass intended security policies by creating overlapping network intervals that the system fails to correctly validate, leading to inconsistent firewall behavior.
Technical details
A vulnerability in 'net/netfilter/nft_set_rbtree.c' was caused by insufficient overlap detection logic for anonymous sets. While userspace provides optimized representations for adjacent intervals by omitting end elements, the kernel's rbtree implementation skipped certain start-element checks for anonymous sets. This allowed the insertion of overlapping intervals (e.g., A-B and A-C where C < B) without triggering the expected -ENOTEMPTY error. An attacker with the ability to manipulate nftables rules could exploit this to create overlapping set elements that bypass intended filtering logic. The fix restores validation by checking if a new start element sits between existing start and end elements using a new 'nft_rbtree_prev_active' helper.
Affected products
- Linux Linux kernel All versions prior to the 2026-03-04 patches
Timeline
- 2026-02-06: other: Initial patch authored by Pablo Neira Ayuso
- 2026-03-04: patched: Patches committed to various stable kernel branches
- 2026-05-27: disclosed: CVE-2026-45873 published
References
- https://git.kernel.org/stable/c/029e5f6a95e905b12d6bc20421be32a01e0eb311
- https://git.kernel.org/stable/c/05feaf826390fd16f1deb89dd9412def3b2a280f
- https://git.kernel.org/stable/c/4780ec142cbb24b794129d3080eee5cac2943ffc
- https://git.kernel.org/stable/c/7ca5813e1b21ef300e04593f47b073ef3217aac6
- https://git.kernel.org/stable/c/dad14d22dff1a191612acb98facceb303d0524a2
- https://git.kernel.org/stable/c/e6497e06a102870803a59570d75ed2c36d7e11b3
- https://git.kernel.org/stable/c/f1381ce0a1dd013610985e1c4260908163a427df