Executive brief
A vulnerability was identified in the Linux kernel's netfilter component, which is responsible for network traffic filtering and firewalling. Specifically, the 'ipset' utility, used to manage groups of IP addresses, contains a logic error when processing ranges of IPv4 addresses. This could potentially allow an attacker to cause the system to process unintended network addresses, leading to unexpected firewall behavior or system instability.
Technical details
A vulnerability exists in several hash set variants of the Linux kernel's ipset component (hash:ip,mark; hash:ip,port; hash:ip,port,ip; and hash:ip,port,net). These variants use a 32-bit iterator to process IPv4 ranges. Due to improper boundary checking, the iterator could advance once more after processing the last address in a requested range. This moves the traversal state past the end of the request, causing subsequent retries to continue from unintended positions. The fix involves explicitly handling the iterator increment at the end of the loop and ensuring it stops once the upper bound is reached.
Affected products
- Linux Linux Kernel 48596a8ddc46 to be75218fadea22e59c8673db212f29c681bf45bb
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
References
- https://git.kernel.org/stable/c/02f75f041a93ea045834da89cd3234f4c1d749b4
- https://git.kernel.org/stable/c/0b530efb2cc9dbdddfd49d392e3a857f0d4ce8dc
- https://git.kernel.org/stable/c/0d3a282ab5f165fc207ff49ea5b6ad8f54616bd6
- https://git.kernel.org/stable/c/0d7b33ace701fe397e6e4de145f32e098178d901
- https://git.kernel.org/stable/c/383418c20e69f5761b6ec5238f599423f4fb77fb
- https://git.kernel.org/stable/c/952e988163c2ab9939c3db9f0f8e77af6a1bb436
- https://git.kernel.org/stable/c/be75218fadea22e59c8673db212f29c681bf45bb