CVE-2026-72349 netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()
An integer truncation bug in the Linux kernel netfilter rate estimator causes incorrect rate comparisons on high-speed links, potentially bypassing rate limiting rules.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72349?
CVE-2026-72349 is a vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()
On links faster than ~34 Gbps, where byte rate may exceed 2^32-1 (~ 4.3 GBps), the comparison result becomes incorrect because the truncated value no longer reflects the actual estimator rate.
Fix by changing the local variables to u64.
Which versions are affected by CVE-2026-72349?
How do I fix CVE-2026-72349?
Apply the vendor's patch.
Is CVE-2026-72349 being exploited?
There is no known exploitation of CVE-2026-72349 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72349, DEBIAN-CVE-2026-72349, GHSA-5288-9525-rfgm, UBUNTU-CVE-2026-72349.