Executive brief
A vulnerability was identified in the Linux kernel's netfilter component, which is responsible for network traffic filtering and firewalling. A technical error in how the system processes certain bitwise operations (like shifting data) could lead to memory corruption when the system tries to read and write to the same memory location simultaneously. This could potentially allow a local attacker to cause system instability or bypass certain security rules.
Technical details
A vulnerability in the nf_tables component of the Linux kernel arises from incorrect register handling during bitwise lshift and rshift operations. The nft_bitwise_eval_lshift and nft_bitwise_eval_rshift functions perform operations in a loop over 32-bit words; however, because the source (src) and destination (dst) registers can point to the same memory location, the carry for subsequent iterations is incorrectly calculated using the already-modified destination value. This results in destination corruption. The fix introduces a temporary local variable to cache the original source value before writing to the destination and adds checks in the control plane (nft_reg_overlap) to reject partially overlapping registers for bitwise and byteorder operations.
Affected products
- Linux Linux Kernel 5.6 to 6.18.35
Timeline
- 2026-05-11: other: Patch authored
- 2026-07-19: disclosed: CVE published