Executive brief
The Linux kernel's netfilter firewall component contains a flaw in how it validates user-supplied shift parameters for packet connection marking rules. An attacker with permission to load firewall rules could provide invalid parameters that trigger undefined behavior when processing network packets, potentially causing system instability or denial of service. The vulnerability affects systems that use connection marking for traffic classification or policy enforcement.
Technical details
The vulnerability exists in the netfilter xt_connmark target (revision 2), which accepts user-controlled shift_bits and shift_dir parameters applied to 32-bit connection mark values in connmark_tg_shift(). A shift_bits value of 32 or greater triggers an undefined-shift bug (left or right shifting by >= the operand width), and invalid shift_dir values silently fall back to left-shift instead of being rejected. The fix adds validation in connmark_tg_check_v2() to reject invalid parameters at rule installation time, before they reach the packet processing path. Exploitation requires CAP_NET_ADMIN or similar privilege to load firewall rules. A patch was committed on 2026-07-03 and backported to stable kernel branches.
Affected products
- Linux Linux kernel Versions with netfilter xt_connmark revision 2 support (approximately 4.0 and later, prior to patched versions)
Timeline
- 2026-08-15: disclosed
- 2026-07-03: patched: Fix committed upstream; backported to stable branches starting 2026-07-24