CVE-2026-72349 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()
On links faster than ~34 Gbps, where byte rate may exceed 2^32-1 (~ 4.3 GBps), the comparison result becomes incorrect because the truncated value no longer reflects the actual estimator rate.
Fix by changing the local variables to u64.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability identified in the Linux kernel's netfilter subsystem affects the xt_rateest module, specifically within the xt_rateest_mt() function that handles rate estimation for network packet filtering. This issue represents a critical precision problem that manifests when dealing with high-speed network links exceeding approximately 34 gigabits per second. The root cause stems from an inadequate data type handling mechanism where 64-bit unsigned integers are prematurely truncated to 32-bit values during rate calculation operations. When byte rates surpass the maximum value of a 32-bit unsigned integer which is 4,294,967,295 bytes per second, the mathematical comparison logic fails to accurately represent the actual network traffic rates due to this truncation artifact.
The technical flaw occurs in the xt_rateest_mt() function where local variables storing rate estimation values are declared with insufficient precision. This design choice creates a scenario where high-speed network traffic measurements become corrupted through implicit type conversion operations that strip away the most significant bits of the 64-bit values. The operational impact is particularly severe for modern network infrastructure supporting gigabit and multi-gigabit connections, where network administrators rely on accurate rate estimation for traffic control, bandwidth management, and quality of service implementations. When the rate estimation becomes inaccurate, it directly affects firewall rules that depend on these measurements, potentially leading to incorrect packet filtering decisions, misconfigured traffic shaping policies, and compromised network security controls.
The fix implemented addresses this vulnerability by modifying the local variable declarations within the xt_rateest_mt() function to utilize 64-bit unsigned integer types throughout the rate estimation calculation process. This change ensures that byte rate values exceeding 32-bit limits are properly preserved without loss of precision during comparison operations. The solution aligns with common security best practices for handling large numerical values in network processing contexts and demonstrates proper adherence to data type integrity requirements. From a cybersecurity perspective, this vulnerability falls under the category of data corruption issues that can affect system reliability and security policy enforcement, potentially creating attack vectors through manipulated rate-based filtering rules.
This issue relates to CWE-194: Unexpected truncation of data and CWE-682: Incorrect calculation, both of which highlight fundamental problems in data type handling within network processing systems. The vulnerability also connects to ATT&CK techniques related to privilege escalation through system component manipulation and resource exhaustion attacks that could exploit incorrect rate estimation for traffic control bypasses. Network security professionals should consider this fix as part of comprehensive kernel security updates, particularly in environments supporting high-speed network connections where accurate rate estimation is critical for maintaining proper network security controls and traffic management policies. The resolution ensures that rate-based filtering mechanisms maintain their integrity across all network speeds while preserving the expected behavior of the xt_rateest module within the broader netfilter framework.