Executive brief
The Linux kernel's netfilter rate estimator module incorrectly compares network traffic rates on high-speed links (faster than ~34 Gbps) due to 32-bit integer truncation. This causes inaccurate rate limiting and traffic classification on modern high-speed networks, potentially affecting quality-of-service enforcement and traffic policing decisions.
Technical details
The vulnerability is an integer truncation bug in the xt_rateest_mt() function within net/netfilter/xt_rateest.c. The function uses 32-bit unsigned integers (u_int32_t) to store byte and packet rate estimates that are read from 64-bit rate estimator structures, causing overflow and loss of precision when actual rates exceed 2^32-1 bytes per second (~4.3 GBps). This occurs on links faster than approximately 34 Gbps. The fix changes the local variables from u_int32_t to u64 to preserve the full rate value during comparison. The vulnerability requires no special privileges or network interaction beyond normal traffic flow; it is a logic error affecting rate calculation accuracy on high-bandwidth links. Patches are available in the Linux kernel stable tree as of late June 2026.
Affected products
- Linux Linux kernel affected versions across linux-2.6.11.y through linux-7.2.y and stable branches
Timeline
- 2026-08-15: disclosed
- 2026-07-03: patched