Executive brief
The Linux kernel's netfilter xt_u32 module is a packet filtering component that applies custom matching rules to network traffic. A malformed rule can specify invalid shift counts that trigger an undefined shift operation during packet evaluation, potentially causing a kernel crash or enabling a denial-of-service attack against systems using these filtering rules.
Technical details
The vulnerability exists in the xt_u32 netfilter module's u32_match_it() function, which processes rule-supplied shift operands (XT_U32_LEFTSH and XT_U32_RIGHTSH) on 32-bit values. An attacker can supply shift counts of 32 or greater, causing undefined behavior due to out-of-bounds bit shifts on 32-bit integers. The fix validates shift counts in u32_mt_checkentry() during rule load time, rejecting any operand with a shift count ≥32 before the rule reaches the packet processing path. This requires the attacker to have the capability to load custom xt_u32 filtering rules on the target system, typically requiring root or CAP_NET_ADMIN.
Affected products
- Linux Linux kernel multiple versions (2.6.11 through 7.2)
Timeline
- 2026-08-15: disclosed
- 2026-06-28: patched: Upstream fix committed
- 2026-07-24: other: Backported to stable kernel series