CVE-2026-74564 PUBLISHED

netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH

Assigner: Linux
Reserved: 15.08.2026 Published: 15.08.2026 Updated: 15.08.2026

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH

The XT_HASHLIMIT_RATE_MATCH flag mode changes the semantics of the dsthash_ent structure which represents an entry in the hashtable. There is a union area which uses a different layout to express the rate match mode.

Update .checkentry path to validate the XT_HASHLIMIT_RATE_MATCH mode flag is requested by two or more different rules that refer to the same hashtable. Otherwise, uninitialized access to the burst field in the union is possible.

Reject the use of the XT_HASHLIMIT_RATE_MATCH mode flag if set on by revision less than 3 too.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from bea74641e3786d51dcf1175527cc1781420961c9 to 24683fea1f06bd3bd2707b99460e859bc6464c22 (excl.)
  • affected from bea74641e3786d51dcf1175527cc1781420961c9 to 32ec8d4aba2cf22e12bdc28df8c4bd833c195fc0 (excl.)
  • affected from bea74641e3786d51dcf1175527cc1781420961c9 to d186f77d18bdfb252d401ff992ca3001a6a65a0f (excl.)
  • affected from bea74641e3786d51dcf1175527cc1781420961c9 to 06a76334243ccd875a981aa8bb46c0f931ef1e3b (excl.)
  • affected from bea74641e3786d51dcf1175527cc1781420961c9 to 305b63e1402267459fdabb183af4527f6799eebf (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 4.14 is affected
  • unaffected from 0 to 4.14 (excl.)
  • unaffected from 6.6.151 to 6.6.* (incl.)
  • unaffected from 6.12.103 to 6.12.* (incl.)
  • unaffected from 6.18.44 to 6.18.* (incl.)
  • unaffected from 7.1.8 to 7.1.* (incl.)
  • unaffected from 7.2-rc6 to * (incl.)

References