Masking Issues in the Linux Kernel's Netfilter Affecting Payload Offloading

CVE-2026-74579

What is CVE-2026-74579?

A vulnerability in the Linux kernel's netfilter component has been identified, particularly in the nft_payload_offload_mask function, which is responsible for creating match masks for payload expressions. The issue arises when the mask is built for partial matches of IPv6 header fields. Specifically, the incorrect construction leads to out-of-bounds shifts on 32-bit integers, where the shift exponent can exceed allowed limits. This misconfiguration may allow for unintended bytes to be included in the mask, potentially leading to incorrect rule matches and security implications. To address this, the updated code now sets the appropriate bytes directly, avoiding the unsafe shift operation and ensuring that the mask aligns with the intended payload without over-masking trailing bytes.

References