CVE-2026-99285— Netfilter nft_byteorder 多寄存器移除漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 Linux 内核中，以下漏洞已得到修复： netfilter: nft_byteorder：移除多寄存器支持 当需要对多个寄存器进行 64 位字节序转换时，转换功能会出现错误。原因是源寄存器数组的步进以 4 字节为单位递增，而非 8 字节： 因此，决定移除多寄存器支持功能，该功能还存在其他问题： Pablo 指出，提交 （"netfilter: nf_tables: 防止 nft_byteorder_eval 中的越界访问"）改变了原有语义：在补丁之前，循环操作的是寄存器，即： 但在补丁之后，循环操作的是字节，
影响版本矩阵 22
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63< 3c5fb3a6c8118d15e60295e76fb5b879021eef43 |
affected |
c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63< dc29c0478b8564feb9371e715b5a0016eb8903fd |
affected | ||
c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63< bb061d3de41707415269be75ebf700efb03ec212 |
affected | ||
fca41e5b687e029f69e3a35a2fa31e2560e538dc |
affected | ||
25b42be4e067e107a2559266b54bf07fa5b094fb |
affected | ||
9a865a11d6890d4a789db1eaafebdc8bd092b12c |
affected | ||
b8b514b2a6cdfac24911e4910461bcb9db15ca8d |
affected | ||
18a169810cff769a7a697b35058c756805f589e0 |
affected | ||
| … +14 条更多 | |||
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-99285 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
netfilter: nft_byteorder: remove multi-register support
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_byteorder: remove multi-register support
64bit byteorder conversion is broken when several registers need to be
converted because the source register array advances in steps for 4 bytes
instead of 8:
for (i = ...
src64 = nft_reg_load64(&src[i]);
~~~~~ u32 *src
nft_reg_store64(&dst64[i],
Remove the multi-register support, it has other issues as well:
Pablo points out that commit
caf3ef7468f7 ("netfilter: nf_tables: prevent OOB access in nft_byteorder_eval")
alters semantics: before the loop operated on registers, i.e.
for ( ... )
dst32[i] = htons((u16)src32[i])
.. but after the patch it will operate on bytes, which makes this
useless to convert e.g. concatenations, which store each compound
in its own register.
Multi-convert of u32 has one theoretical application:
ct mark . meta mark . tcp dport @intervalset
Because ct mark and meta mark are host byte order, use with
intervals has to convert the byteorder for ct/meta mark value
to network byte order (bigendian).
nftables emits this:
[ meta load mark => reg 1 ]
[ byteorder reg 1 = hton(reg 1, 4, 4) ]
[ ct load mark => reg 9 ]
[ byteorder reg 9 = hton(reg 9, 4, 4) ]
...
I.e. two separate calls. Theoretically it could be changed to do:
[ meta load mark => reg 1 ]
[ ct load mark => reg 9 ]
[ byteorder reg 1 = htonl(reg 1, 4, 8) ]
...
But then all it would take to change the set to
meta mark . tcp dport . ct mark
... and we'd be back to two "byteorder" calls. IOW, support to
convert a range of registers is both dysfunctional and dubious.
Simplify this: remove the feature.
Pablo Neira Ayuso points out that nftables before 1.1.0 can generate
incorrect byteorder conversions, see 9fe58952c45a,
"evaluate: skip byteorder conversion for selector smaller than 2 bytes"
in nftables.git). Affected rulesets fail to load with this change and
old userspace due to 'len != size' check.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-99285 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-99285 的情报信息
请登录查看更多情报信息。
CVE-2026-99285 补丁与修复 (3)
同批安全公告 · Linux · 2026-11-10 · 共 4 条
| CVE-2026-99286 | Xen-netback 后端 XenBus 连接失败清理漏洞 | |
| CVE-2026-99287 | Xen-netback 零化 sring 指针远程代码执行漏洞 | |
| CVE-2026-99288 | inet 未哈希套接字拒绝漏洞 |