Vulnerability in Linux Kernel Affects Hash Set Variants

CVE-2026-52921

What is CVE-2026-52921?

A vulnerability in the Linux kernel's netfilter module affects the iteration of IPv4 ranges in certain ipset hash set variants, including hash:ip,mark, hash:ip,port, and more. The iterator may improperly advance beyond the last address, allowing traversal to continue past the intended boundary. This flaw necessitates explicit handling of the iterator increment to ensure it halts once the upper limit has been processed. This correction maintains the retry behavior for valid ranges while mitigating unintended state advancements.

References