CVE-2026-74579 in Linux
Summary
by MITRE • 08/17/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_payload: fix mask build for partial field offload
nft_payload_offload_mask() builds the offload match mask for a payload expression that covers only part of a header field. For a partial IPv6 address match (field_len = 16, priv_len = 1) that shift is 1 << 120, which is undefined on the 32-bit int operand. It also trims only one word, so the remaining words stay 0xffffffff (and when priv_len is a multiple of 4 the trim is skipped entirely), leaving the mask covering more bytes than the rule matches.
UBSAN: shift-out-of-bounds in net/netfilter/nft_payload.c:278:20 shift exponent 120 is too large for 32-bit type 'int' ...
The match is byte-granular and struct nft_data is zero-initialised, so the correct mask is simply the first priv_len bytes set to 0xff. Set those bytes directly and drop the word/shift trimming; this removes the undefined shift and no longer over-masks the trailing bytes.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in the Linux kernel within the netfilter subsystem, specifically affecting the nft_payload module, represents a critical flaw in how partial field offload masks are constructed for network packet matching rules. This issue arises when the system attempts to build an offload match mask for payload expressions that cover only a portion of a header field rather than the entire structure. The core technical failure occurs during bit shifting operations intended to isolate specific bytes within larger data structures, such as IPv6 addresses. When processing partial matches where the private length is significantly smaller than the total field length, the kernel calculates a shift amount by subtracting the private length from the field length and then attempting to left-shift a value based on that difference. In scenarios involving large fields like 128-bit IPv6 addresses with small match lengths, this calculation results in excessively large shift exponents that exceed the capacity of standard integer types used in the operation.
This improper handling leads directly to undefined behavior as defined by programming language standards and detected by tools such as the Undefined Behavior Sanitizer (UBSAN). Specifically, when attempting a partial IPv6 address match with a field length of 16 bytes and a private length of one byte, the system attempts to perform a shift operation equivalent to moving bits by 120 positions. Since this value is applied against a thirty-two-bit integer operand, it triggers a shift-out-of-bounds error because shifting an int type by more than its bit width is undefined behavior in C and similar languages. This not only compromises the stability of the kernel but also introduces potential security risks where unpredictable execution paths could be exploited to cause denial of service or potentially escalate privileges if the resulting corrupted mask interacts with other memory management routines in unexpected ways.
Beyond the immediate crash risk, the vulnerability causes functional incorrectness in packet filtering logic due to improper masking of trailing bytes. The original implementation attempted to trim only one word from the mask calculation, leaving remaining words set to all ones (0xffffffff). When the private length is a multiple of four bytes, this trimming process is skipped entirely, resulting in a mask that covers significantly more data than intended by the rule definition. This over-masking means that packet filters may incorrectly match or reject traffic based on bits outside the specified range, effectively bypassing security policies designed to restrict access based on specific header fields. Such behavior undermines the precision required for effective network segmentation and firewall rules, allowing unauthorized connections or blocking legitimate traffic due to false positives in pattern matching.
From a classification perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound as it involves incorrect arithmetic leading to invalid memory access patterns, and CWE-787 Out-of-bounds Write if the corrupted mask leads to writing beyond intended buffer boundaries during offload processing. In terms of adversary tactics, while primarily a stability issue, improper kernel state manipulation can be leveraged in denial-of-service attacks categorized under MITRE ATT&CK technique T1499 Endpoint Denial of Service or potentially T1053 Scheduled Task/Job if the instability leads to system crashes that disrupt service availability. The root cause lies in the lack of bounds checking on shift operations and insufficient validation of mask construction logic for variable-length field matches, which fails to adhere to safe coding practices required for low-level systems programming.
The resolution implemented by the Linux kernel maintainers addresses these issues by fundamentally restructuring how the offload match mask is generated. Instead of relying on complex bit-shifting arithmetic that risks overflow and undefined behavior, the fix simplifies the logic to directly set the first private length bytes to 0xff while ensuring all other bytes remain zero through proper initialization. This approach eliminates the need for word trimming operations that were prone to errors when handling multiples of four-byte boundaries. By dropping the problematic shift and trim mechanisms in favor of direct byte-level manipulation, the code ensures that the mask accurately reflects only the intended portion of the header field. This change not only resolves the undefined behavior detected by UBSAN but also guarantees precise packet matching semantics consistent with user-defined rules.
To mitigate similar vulnerabilities in other systems or to ensure ongoing security posture, developers should enforce strict bounds checking on all bit manipulation operations involving variable lengths derived from external inputs or configuration parameters. Adhering to CWE-120 Buffer Copy without Checking Size of Input guidelines is essential when constructing masks or buffers based on dynamic length values. Furthermore, integrating static analysis tools and undefined behavior sanitizers into the continuous integration pipeline can help detect such integer overflow issues before deployment. For system administrators using netfilter-based firewalls, ensuring that kernel updates are applied promptly is critical to prevent exploitation of these stability flaws which could otherwise be used to destabilize network infrastructure components relying on precise packet inspection capabilities.