Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-74579— netfilter: nft_payload: fix mask build for partial field offload

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 存在安全漏洞，该漏洞源于netfilter nft_payload组件在构建部分字段卸载掩码时存在未定义移位，可能导致移位越界并造成内核崩溃。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.17% · P6

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 20

VendorProduct Version RangeStatus
Linux Linux a5d45bc0dc50f9dd83703510e9804d813a9cac32< 3ee7b3f813b11f28cd6efdf7f24d64b5a7fd4dc7 affected
a5d45bc0dc50f9dd83703510e9804d813a9cac32< 8720df4504e0ed1781a702f65251bd47b3534d5e affected
a5d45bc0dc50f9dd83703510e9804d813a9cac32< 363c3a84a946d53e5e121c9f47c7c2b7d228c46b affected
a5d45bc0dc50f9dd83703510e9804d813a9cac32< b19b5d2e042c294e2cc1c908dc598f9d64015396 affected
a5d45bc0dc50f9dd83703510e9804d813a9cac32< a375d8ace807767f29f276b681b6324c74929b1d affected
a5d45bc0dc50f9dd83703510e9804d813a9cac32< 16b553c46e347bc9de9946c4960654d5884a86de affected
a5d45bc0dc50f9dd83703510e9804d813a9cac32< 630295d5bba1d0e0f494cc459452eb0a0058c545 affected
a5d45bc0dc50f9dd83703510e9804d813a9cac32< 39e88f28fb32bf02bd4b525c24c842c9cff5663d affected
… +12 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-74579

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
netfilter: nft_payload: fix mask build for partial field offload
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_payload: fix mask build for partial field offload nft_payload_offload_mask() builds the offload match mask for a payload expression that covers only part of a header field. For a partial IPv6 address match (field_len = 16, priv_len = 1) that shift is 1 << 120, which is undefined on the 32-bit int operand. It also trims only one word, so the remaining words stay 0xffffffff (and when priv_len is a multiple of 4 the trim is skipped entirely), leaving the mask covering more bytes than the rule matches. UBSAN: shift-out-of-bounds in net/netfilter/nft_payload.c:278:20 shift exponent 120 is too large for 32-bit type 'int' ... The match is byte-granular and struct nft_data is zero-initialised, so the correct mask is simply the first priv_len bytes set to 0xff. Set those bytes directly and drop the word/shift trimming; this removes the undefined shift and no longer over-masks the trailing bytes.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 存在安全漏洞，该漏洞源于netfilter nft_payload组件在构建部分字段卸载掩码时存在未定义移位，可能导致移位越界并造成内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux a5d45bc0dc50f9dd83703510e9804d813a9cac32 ~ 3ee7b3f813b11f28cd6efdf7f24d64b5a7fd4dc7 -
Linux Linux 5.10 -

II. Public POCs for CVE-2026-74579

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74579

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-74579 (4)

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-74579

No comments yet

Leave a comment