Executive brief
Linux kernel's netfilter packet filtering subsystem contains a logic error in the nft_lookup module that affects inverted set membership lookups. The bug causes the packet filtering rules to reach incorrect verdicts when using negated lookups (!=) with interval sets, potentially allowing packets that should be blocked to pass through or blocking packets that should pass, compromising network security policy enforcement.
Technical details
The vulnerability is a logic error in nft_lookup_eval() function of the netfilter nft_lookup module. The function computes a match decision (found) based on direct set lookup and invert flag before consulting the catchall element used by interval sets. Because the found variable is not recomputed after the catchall element is fetched, inverted lookups (NFT_LOOKUP_F_INV) can incorrectly match or skip the catchall element, producing wrong packet filtering verdicts. The fix reorders operations to fold the catchall lookup into the extension variable before computing the found decision. This is a kernel-level vulnerability affecting all systems using nftables with interval set rules; no user authentication is required as the exploitation occurs during normal packet processing. The vulnerability allows bypassing or inverting packet filtering policies, leading to unauthorized traffic flow or denial of legitimate traffic.
Affected products
- Linux Linux kernel 5.x, 6.x, 7.x (all versions with nftables catchall support)
Timeline
- 2026-08-15: disclosed: CVE-2026-72320 published
- 2026-07-24: patched: Fix committed to stable kernel trees
- 2026-07-03: other: Upstream commit e6107a4c74b54cb33e3bce162a63048ae5a6b198 by Tamaki Yanagawa