Executive brief
The Linux kernel's netfilter packet filtering module contains a vulnerability in the xt_hashlimit rate-limiting component that allows uninitialized memory to be accessed when conflicting rate-match mode configurations are applied to the same hash table. An attacker with the ability to set firewall rules could trigger this flaw, potentially leading to information disclosure or denial of service on systems using this netfilter feature.
Technical details
The vulnerability exists in net/netfilter/xt_hashlimit.c where the XT_HASHLIMIT_RATE_MATCH flag mode changes the memory layout of the dsthash_ent union structure within a shared hash table. When different iptables/netfilter rules reference the same hash table but disagree on whether the rate-match mode should be enabled, uninitialized fields (specifically the burst field in the union) can be accessed. The fix adds validation in the hashlimit_mt_check_common() function to: (1) reject XT_HASHLIMIT_RATE_MATCH on rule revisions less than 3, and (2) ensure all rules sharing a hash table agree on the rate-match mode flag. Exploitation requires the ability to configure netfilter rules, typically requiring root or CAP_NET_ADMIN capability.
Affected products
- Linux Linux kernel versions prior to the patch; affects multiple kernel series including 4.x, 5.x, 6.x, and 7.x
Timeline
- 2026-08-15: disclosed: Published on NVD
- 2026-07-21: patched: Upstream commit 305b63e1402267459fdabb183af4527f6799eebf by Pablo Neira Ayuso
- 2026-08-09: other: Backported to stable kernel series via commits 06a76334243ccd875a981aa8bb46c0f931ef1e3b and 24683fea1f06bd3bd2707b99460e859bc6464c22