Linux Kernel Netfilter Vulnerability in Byteorder Conversion

CVE-2026-99285

What is CVE-2026-99285?

A vulnerability exists in the Linux kernel's netfilter component related to byteorder conversions during multiple register operations. The original implementation erroneously advanced source register arrays in 4-byte steps rather than the required 8 bytes, leading to improper conversions. As a result, affected rulesets in nftables were unable to load correctly if the new semantics changed from register-based operations to byte-based operations. The multi-register support was deemed dysfunctional, prompting its removal to simplify the process and avoid potential failures in older user space due to mismatched lengths. This change highlights the complexities in ensuring correct byteorder handling in packet filtering and network operations.

References