CVE-2026-74564 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
The XT_HASHLIMIT_RATE_MATCH flag mode changes the semantics of the dsthash_ent structure which represents an entry in the hashtable. There is a union area which uses a different layout to express the rate match mode.
Update .checkentry path to validate the XT_HASHLIMIT_RATE_MATCH mode flag is requested by two or more different rules that refer to the same hashtable. Otherwise, uninitialized access to the burst field in the union is possible.
Reject the use of the XT_HASHLIMIT_RATE_MATCH mode flag if set on by revision less than 3 too.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/16/2026
The vulnerability resides in the Linux kernel's netfilter subsystem within the xt_hashlimit module, which implements rate limiting functionality for network traffic. This specific issue affects how the module handles hash table entries when operating in rate match mode, creating a potential for uninitialized memory access that could lead to system instability or privilege escalation. The problem stems from the xt_hashlimit module's handling of the XT_HASHLIMIT_RATE_MATCH flag, which fundamentally alters the data structure layout for hashtable entries through a union type that supports different semantic interpretations based on operational mode.
The technical flaw manifests when multiple rules reference the same hash table but operate under different modes of operation, specifically when one rule uses the rate match functionality while another does not. The dsthash_ent structure employs a union to optimize memory usage by sharing storage space for different data representations, but this optimization becomes problematic when the module fails to validate that all referencing rules consistently use the same operational mode. When rules with differing modes reference identical hash tables, the system may access uninitialized memory locations within the burst field of the union, creating a scenario where arbitrary data could be read from memory locations that have not been properly initialized.
The operational impact of this vulnerability extends beyond simple memory corruption, as it represents a potential path for privilege escalation and system compromise. Attackers could exploit this condition by crafting specific iptables rules that create conflicting hash table usage patterns, potentially leading to information disclosure or denial of service conditions. The vulnerability affects systems running Linux kernels with netfilter support, particularly those utilizing advanced rate limiting capabilities in firewall configurations. According to CWE classification, this represents a weakness in the design of data structure handling and memory management within network filtering components. The issue aligns with ATT&CK technique T1068 by leveraging kernel-level privilege escalation through malformed input processing.
The mitigation strategy requires enforcement of consistent rule behavior across hash table references through enhanced validation during the .checkentry path execution. The fix implements proper checking to ensure that when XT_HASHLIMIT_RATE_MATCH mode is enabled, all rules referencing the same hashtable must consistently use this mode, preventing the union from being accessed in an uninitialized state. Additionally, the implementation rejects older revision numbers that do not properly support the rate match functionality, ensuring backward compatibility while preventing exploitation of legacy code paths. This approach aligns with security best practices for kernel module validation and demonstrates the importance of proper input sanitization and consistent state management in operating system components. The resolution effectively prevents uninitialized memory access by enforcing operational consistency across related network filtering rules while maintaining the intended functionality of rate limiting features.