CVE-2026-74579: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-74579 is a vulnerability in the Linux kernel's netfilter nft_payload module caused by an improper mask calculation in the nft_payload_offload_mask() function. When building the offload match mask for a payload expression covering only part of a header field (e.g., a partial IPv6 address match), the function performs an undefined shift operation — specifically 1 << 120 on a 32-bit int — triggering a UBSAN shift-out-of-bounds error. Additionally, the mask trimming logic is incomplete, causing trailing bytes to be over-masked beyond what the rule actually matches. The vulnerability affects Linux kernel versions from 5.9.14 up to (but not including) 5.10, and from 5.10 onward until the respective stable-branch fixes. It was disclosed on August 17, 2026, with a CVSS estimated severity of Medium and an EPSS score of approximately 0.157% (GitHub Advisory, ENISA EUVD).

The root cause is an undefined behavior (UB) shift operation in net/netfilter/nft_payload.c at line 278, classifiable under CWE-682 (Incorrect Calculation). In nft_payload_offload_mask(), when priv_len is small relative to field_len (e.g., 1 byte out of a 16-byte IPv6 address), the computed shift exponent (120) exceeds the width of the 32-bit int operand, which is undefined behavior per the C standard. Furthermore, the word-level trimming loop only corrects one word, leaving the remaining words of the mask as 0xffffffff, and skips trimming entirely when priv_len is a multiple of 4. The fix replaces the shift-and-trim logic by directly setting the first priv_len bytes of the zero-initialized nft_data struct to 0xff, eliminating both the UB shift and the over-masking (GitHub Advisory, ENISA EUVD).

An attacker with local access sufficient to configure netfilter rules can craft payload expressions that exploit the incorrect mask to cause packet filtering rules to match traffic incorrectly. This primarily affects integrity of firewall policy enforcement — specifically, packets that should be blocked or redirected may instead pass through unfiltered, enabling firewall bypass. The vulnerability does not directly expose confidential data or crash the system, but incorrect packet matching could facilitate network-level tampering or evasion of security controls (ENISA EUVD, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (GitHub Advisory). The vulnerability requires local access to configure netfilter rules, significantly limiting the attack surface. The EPSS score is approximately 0.157%, indicating a low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (ENISA EUVD).

Patches have been released for all affected stable kernel branches. The fixed versions are: 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2 (mainline). Administrators should update to the appropriate patched kernel version for their branch as soon as possible (GitHub Advisory, ENISA EUVD). As an interim workaround, restrict access to netfilter rule configuration to trusted administrators only, and audit existing netfilter payload-based rules — particularly those performing partial IPv6 address matches — to verify they behave as intended on unpatched systems.