CVE-2026-72320 netfilter: nft_lookup: fix catchall element handling with inverted lookups
A logic error in Linux kernel netfilter allows inverted lookups to incorrectly match catchall elements, potentially bypassing firewall rules.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72320?
CVE-2026-72320 is a critical vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_lookup: fix catchall element handling with inverted lookups
nft_lookup_eval() decides whether a lookup matched (`found`) from the direct set lookup and priv->invert before falling back to the catchall element used by interval sets (e.g. nft_set_rbtree) for the open-ended default range. Since `found` is never recomputed after `ext` is replaced by the catchall lookup, inverted lookups (NFT_LOOKUP_F_INV, "!= @set") can wrongly match or wrongly skip the catchall element, producing the wrong verdict. Fold the catchall lookup into `ext` before computing `found`, matching the order already used by nft_objref_map_eval().
Which versions are affected by CVE-2026-72320?
How do I fix CVE-2026-72320?
Apply the vendor's patch.
Is CVE-2026-72320 being exploited?
There is no known exploitation of CVE-2026-72320 in the wild and no public exploit code.
Sources
Also known as AZL-96594, BELL-CVE-2026-72320, DEBIAN-CVE-2026-72320, GHSA-xm9x-r949-vc7p, UBUNTU-CVE-2026-72320.