GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72320 (GCVE-0-2026-72320)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:42
VLAI
Title
netfilter: nft_lookup: fix catchall element handling with inverted lookups
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_lookup: fix catchall element handling with inverted lookups nft_lookup_eval() decides whether a lookup matched (`found`) from the direct set lookup and priv->invert before falling back to the catchall element used by interval sets (e.g. nft_set_rbtree) for the open-ended default range. Since `found` is never recomputed after `ext` is replaced by the catchall lookup, inverted lookups (NFT_LOOKUP_F_INV, "!= @set") can wrongly match or wrongly skip the catchall element, producing the wrong verdict. Fold the catchall lookup into `ext` before computing `found`, matching the order already used by nft_objref_map_eval().
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: aaa31047a6d25da0fa101da1ed544e1247949b40 , < 0ab8880865f9678eb6174e72c1fc4712e44c745c (git)
Affected: aaa31047a6d25da0fa101da1ed544e1247949b40 , < 238c612357b5a25f03eacf356f95034f8551f218 (git)
Affected: aaa31047a6d25da0fa101da1ed544e1247949b40 , < ef0c7d4b04a0e6ad175323c24bc84e11470dd79d (git)
Affected: aaa31047a6d25da0fa101da1ed544e1247949b40 , < e6107a4c74b54cb33e3bce162a63048ae5a6b198 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_lookup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0ab8880865f9678eb6174e72c1fc4712e44c745c",
              "status": "affected",
              "version": "aaa31047a6d25da0fa101da1ed544e1247949b40",
              "versionType": "git"
            },
            {
              "lessThan": "238c612357b5a25f03eacf356f95034f8551f218",
              "status": "affected",
              "version": "aaa31047a6d25da0fa101da1ed544e1247949b40",
              "versionType": "git"
            },
            {
              "lessThan": "ef0c7d4b04a0e6ad175323c24bc84e11470dd79d",
              "status": "affected",
              "version": "aaa31047a6d25da0fa101da1ed544e1247949b40",
              "versionType": "git"
            },
            {
              "lessThan": "e6107a4c74b54cb33e3bce162a63048ae5a6b198",
              "status": "affected",
              "version": "aaa31047a6d25da0fa101da1ed544e1247949b40",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_lookup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_lookup: fix catchall element handling with inverted lookups\n\nnft_lookup_eval() decides whether a lookup matched (`found`) from the\ndirect set lookup and priv-\u003einvert before falling back to the\ncatchall element used by interval sets (e.g. nft_set_rbtree) for the\nopen-ended default range. Since `found` is never recomputed after\n`ext` is replaced by the catchall lookup, inverted lookups\n(NFT_LOOKUP_F_INV, \"!= @set\") can wrongly match or wrongly skip the\ncatchall element, producing the wrong verdict. Fold the catchall\nlookup into `ext` before computing `found`, matching the order\nalready used by nft_objref_map_eval()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - nft_lookup_eval() runs on the netfilter packet datapath via nft_do_chain() for ingress/forward/prerouting hooks, so a remote sender can reach the bug by sending packets evaluated against an affected inverted lookup rule on a catchall interval set.\nAC:L - Once such a ruleset exists, the attacker reliably controls whether the lookup key hits a set element or the catchall by crafting packet fields; no race, memory layout dependency, or other uncontrollable victim state is required.\nPR:N - Exploitation at runtime only requires sending network traffic through the victim\u0027s nftables hooks; although rule installation needs CAP_NET_ADMIN, the remote attacker needs no credentials or local privileges on the target system.\nUI:N - No victim user interaction is needed beyond normal network traffic processing; the kernel automatically evaluates the inverted lookup expression for each matching packet.\nS:U - The impact is incorrect nftables verdicts within the host/kernel network security authority and does not cross VM, container-host, or IOMMU security boundaries.\nC:H - Wrongly matching or skipping the catchall element can bypass intended filtering and expose protected internal services or data that the firewall policy was meant to block from the attacker\u0027s network position.\nI:H - The bug can apply or omit catchall set-element actions and verdicts (accept/drop/jump), allowing unauthorized traffic handling contrary to the administrator\u0027s intended nftables policy.\nA:N - This is a pure logic error that returns incorrect verdicts without memory corruption, kernel oops/panic, hang, or other direct loss of kernel availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:42:46.791Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0ab8880865f9678eb6174e72c1fc4712e44c745c"
        },
        {
          "url": "https://git.kernel.org/stable/c/238c612357b5a25f03eacf356f95034f8551f218"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef0c7d4b04a0e6ad175323c24bc84e11470dd79d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6107a4c74b54cb33e3bce162a63048ae5a6b198"
        }
      ],
      "title": "netfilter: nft_lookup: fix catchall element handling with inverted lookups",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72320",
    "datePublished": "2026-08-15T05:55:32.939Z",
    "dateReserved": "2026-08-09T03:40:39.919Z",
    "dateUpdated": "2026-08-17T05:42:46.791Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72320",
      "date": "2026-09-04",
      "epss": "0.00523",
      "percentile": "0.42428"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T14:44:37.000Z",
      "cve": "CVE-2026-72320",
      "id": "msrc_CVE-2026-72320",
      "initial_release_date": "2026-08-23T14:44:37.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "netfilter: nft_lookup: fix catchall element handling with inverted lookups",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-72320.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72320\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:04.993\",\"lastModified\":\"2026-08-17T06:18:35.467\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nft_lookup: fix catchall element handling with inverted lookups\\n\\nnft_lookup_eval() decides whether a lookup matched (`found`) from the\\ndirect set lookup and priv-\u003einvert before falling back to the\\ncatchall element used by interval sets (e.g. nft_set_rbtree) for the\\nopen-ended default range. Since `found` is never recomputed after\\n`ext` is replaced by the catchall lookup, inverted lookups\\n(NFT_LOOKUP_F_INV, \\\"!= @set\\\") can wrongly match or wrongly skip the\\ncatchall element, producing the wrong verdict. Fold the catchall\\nlookup into `ext` before computing `found`, matching the order\\nalready used by nft_objref_map_eval().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/netfilter/nft_lookup.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"aaa31047a6d25da0fa101da1ed544e1247949b40\",\"lessThan\":\"0ab8880865f9678eb6174e72c1fc4712e44c745c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aaa31047a6d25da0fa101da1ed544e1247949b40\",\"lessThan\":\"238c612357b5a25f03eacf356f95034f8551f218\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aaa31047a6d25da0fa101da1ed544e1247949b40\",\"lessThan\":\"ef0c7d4b04a0e6ad175323c24bc84e11470dd79d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aaa31047a6d25da0fa101da1ed544e1247949b40\",\"lessThan\":\"e6107a4c74b54cb33e3bce162a63048ae5a6b198\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/netfilter/nft_lookup.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0ab8880865f9678eb6174e72c1fc4712e44c745c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/238c612357b5a25f03eacf356f95034f8551f218\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e6107a4c74b54cb33e3bce162a63048ae5a6b198\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ef0c7d4b04a0e6ad175323c24bc84e11470dd79d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-18T21:22:14+00:00",
      "cve": "CVE-2026-72320",
      "id": "CVE-2026-72320",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72320.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.