Incorrect Pointer Scaling in Linux kernel - CVE-2026-99285
Published: November 11, 2026
Vulnerability identifier: #VU165075
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-99285
CWE-ID: CWE-468
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to cause incorrect byte-order conversions and potentially alter nftables rule evaluation.
The vulnerability exists due to incorrect pointer scaling in the Linux kernel's nft_byteorder_eval() function when converting multiple 64-bit register values. A local privileged user can configure a multi-register byte-order expression to cause source reads to advance by four bytes instead of eight, producing incorrect conversion results that may affect rule evaluation.
Affected software
Linux kernel
How to mitigate CVE-2026-99285
Install security update from vendor's repository.