Executive brief
A vulnerability was identified in the Linux kernel's Netfilter component, which manages network traffic filtering and firewall rules. An issue in how the system handles specific mathematical 'bitwise' operations could lead to unpredictable system behavior or crashes. This has been resolved by ensuring that invalid rule configurations are rejected before they can affect the system's network processing path.
Technical details
A vulnerability in the nft_bitwise component of the Linux kernel's Netfilter subsystem allowed for undefined behavior due to improper validation of shift operands. Specifically, the carry propagation logic calculates the carry from adjacent 32-bit words using the formula '32 - shift'. If a shift value of zero is provided, it results in a 32-bit shift on a 32-bit type, which is undefined behavior in C. This issue occurs during the initialization of nft_bitwise left and right shift expressions. The fix introduces a check in the control plane to reject zero shift operands, preventing malformed rules from reaching the packet processing path. The vulnerability is reachable via the nftables configuration interface.
Affected products
- Linux Linux Kernel Fixed in versions 6.1.90, 6.6.30, 6.8.9, and 6.9.0
Timeline
- 2026-04-22: other: Patch authored
- 2026-05-27: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/6f820139d16a4c9865a145d4a9cf9c92cc632c14
- https://git.kernel.org/stable/c/bffef0acec9c3b837a785248a893137fb7f26c95
- https://git.kernel.org/stable/c/ca24f1243ad1a4d12d6a23876bbbe3ed02099853
- https://git.kernel.org/stable/c/f370205974f171a5868c13ff30d7642fed46e47b
- https://git.kernel.org/stable/c/fe11e5c40817b84abaa5d83bfb6586d8412bfd07