Incorrect Bitwise Shift of Integer in Linux kernel - CVE-2026-74579
Published: August 21, 2026
Vulnerability identifier: #VU144575
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-74579
CWE-ID: CWE-1335
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to cause incorrect netfilter payload offload matching.
The vulnerability exists due to undefined shift behavior in nft_payload_offload_mask() in net/netfilter/nft_payload.c when building an offload match mask for a payload expression that covers only part of a header field. A local privileged user can configure a crafted nftables payload rule with a partial header field match to cause incorrect netfilter payload offload matching.
The issue occurs for partial field matches such as a partial IPv6 address match where the match length is shorter than the header field length.
Affected software
Linux kernel
How to mitigate CVE-2026-74579
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/16b553c46e347bc9de9946c4960654d5884a86de
- https://git.kernel.org/stable/c/363c3a84a946d53e5e121c9f47c7c2b7d228c46b
- https://git.kernel.org/stable/c/39e88f28fb32bf02bd4b525c24c842c9cff5663d
- https://git.kernel.org/stable/c/3ee7b3f813b11f28cd6efdf7f24d64b5a7fd4dc7
- https://git.kernel.org/stable/c/630295d5bba1d0e0f494cc459452eb0a0058c545
- https://git.kernel.org/stable/c/8720df4504e0ed1781a702f65251bd47b3534d5e
- https://git.kernel.org/stable/c/a375d8ace807767f29f276b681b6324c74929b1d
- https://git.kernel.org/stable/c/b19b5d2e042c294e2cc1c908dc598f9d64015396