CVE-2026-72350 netfilter: xt_u32: reject invalid shift counts
A malformed netfilter u32 rule with invalid shift counts causes undefined behavior in the Linux kernel, potentially leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72350?
CVE-2026-72350 is a high-severity vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_u32: reject invalid shift counts
u32_match_it() executes rule-supplied shift operands on a 32-bit value. A malformed u32 rule can provide a shift count of 32 or more, triggering an undefined shift out-of-bounds during packet evaluation.
Validate XT_U32_LEFTSH and XT_U32_RIGHTSH operands in u32_mt_checkentry() and reject malformed rules before they reach the packet path.
Which versions are affected by CVE-2026-72350?
How do I fix CVE-2026-72350?
Apply the vendor's patch.
Is CVE-2026-72350 being exploited?
There is no known exploitation of CVE-2026-72350 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72350, DEBIAN-CVE-2026-72350, GHSA-3cfm-hj78-94wf, UBUNTU-CVE-2026-72350.