CVE-2026-99285: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-99285 is a memory corruption vulnerability in the Linux kernel's netfilter nft_byteorder module, caused by incorrect pointer arithmetic during multi-register 64-bit byteorder conversion operations. The source register array advances in 4-byte steps instead of the required 8-byte steps, leading to out-of-bounds register access and potential system crashes. It was published on November 10, 2026, and affects multiple stable kernel branches. Affected versions include Linux kernel 4.19.307–4.20, 5.4.269–5.5, 5.10.210–5.11, 5.15.140–5.16, 6.1.64–6.2, 6.5.13–6.6, 6.6.3–6.7, and 6.7. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an out-of-bounds write (CWE-787) in the nft_byteorder_eval function within the Linux kernel's netfilter subsystem. When performing 64-bit byteorder conversions across multiple registers, the loop iterates using a u32 *src pointer that advances by 4 bytes per step (src[i]), but 64-bit values require 8-byte alignment, causing the load (nft_reg_load64) to read from incorrect memory offsets. This was compounded by a prior patch (caf3ef7468f7) that altered loop semantics from register-based to byte-based iteration, making multi-register conversion both functionally broken and semantically incorrect. The fix removes multi-register support entirely from nft_byteorder, requiring separate byteorder calls per register (GitHub Advisory, Red Hat Bugzilla).

A local user with CAP_NET_ADMIN capability (typically root or a privileged container context) can craft netfilter rules that trigger incorrect byteorder conversions, resulting in memory access violations or kernel crashes (denial of service). The vulnerability's impact is limited to availability — there is no assessed confidentiality or integrity impact. Lateral movement potential is low given the local privilege requirement, but a crash could disrupt all services on the affected host (Red Hat Bugzilla, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability requires local access with CAP_NET_ADMIN privileges, significantly limiting the attack surface. It is not listed in the CISA Known Exploited Vulnerabilities catalog, and no threat actor attribution has been reported (GitHub Advisory, Red Hat Bugzilla).

Update the Linux kernel to a patched version: 4.20 or later, 5.5 or later, 5.11 or later, 5.16 or later, 6.2 or later, 6.6 or later, or 6.7 (with the fix applied). Stable kernel patches are available at the upstream kernel git repository (commits 3c5fb3a6c811, dc29c0478b85, and bb061d3de417). As a workaround, restrict CAP_NET_ADMIN access to trusted administrators only, or disable nftables/netfilter if not required in the environment. Note that nftables userspace versions before 1.1.0 may generate affected rulesets; upgrading nftables userspace alongside the kernel is recommended (GitHub Advisory, Red Hat Bugzilla).