CVE-2026-74579 netfilter: nft_payload: fix mask build for partial field offload
A bug in Linux kernel netfilter payload offloading causes undefined behavior and incorrect masking, potentially leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74579?
CVE-2026-74579 is a high-severity vulnerability in Linux, published on 17 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_payload: fix mask build for partial field offload
nft_payload_offload_mask() builds the offload match mask for a payload expression that covers only part of a header field. For a partial IPv6 address match (field_len = 16, priv_len = 1) that shift is 1 << 120, which is undefined on the 32-bit int operand. It also trims only one word, so the remaining words stay 0xffffffff (and when priv_len is a multiple of 4 the trim is skipped entirely), leaving the mask covering more bytes than the rule matches.
UBSAN: shift-out-of-bounds in net/netfilter/nft_payload.c:278:20 shift exponent 120 is too large for 32-bit type 'int' ...
The match is byte-granular and struct nft_data is zero-initialised, so the correct mask is simply the first priv_len bytes set to 0xff. Set those bytes directly and drop the word/shift trimming; this removes the undefined shift and no longer over-masks the trailing bytes.
Which versions are affected by CVE-2026-74579?
How do I fix CVE-2026-74579?
Apply the vendor's patch.
Is CVE-2026-74579 being exploited?
There is no known exploitation of CVE-2026-74579 in the wild and no public exploit code.
Sources
Also known as AZL-96600, BELL-CVE-2026-74579, DEBIAN-CVE-2026-74579, GHSA-h46j-5f2w-jjq4, UBUNTU-CVE-2026-74579.