{"api_version":"1","generated_at":"2026-10-27T07:58:23+00:00","cve":"CVE-2026-72320","urls":{"html":"https://cve.report/CVE-2026-72320","api":"https://cve.report/api/cve/CVE-2026-72320.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-72320","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-72320"},"summary":{"title":"netfilter: nft_lookup: fix catchall element handling with inverted lookups","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_lookup: fix catchall element handling with inverted lookups\n\nnft_lookup_eval() decides whether a lookup matched (`found`) from the\ndirect set lookup and priv->invert before falling back to the\ncatchall element used by interval sets (e.g. nft_set_rbtree) for the\nopen-ended default range. Since `found` is never recomputed after\n`ext` is replaced by the catchall lookup, inverted lookups\n(NFT_LOOKUP_F_INV, \"!= @set\") can wrongly match or wrongly skip the\ncatchall element, producing the wrong verdict. Fold the catchall\nlookup into `ext` before computing `found`, matching the order\nalready used by nft_objref_map_eval().","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-15 06:22:04","updated_at":"2026-10-21 13:19:34"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"9.1","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"9.1","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","data":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/238c612357b5a25f03eacf356f95034f8551f218","name":"https://git.kernel.org/stable/c/238c612357b5a25f03eacf356f95034f8551f218","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ef0c7d4b04a0e6ad175323c24bc84e11470dd79d","name":"https://git.kernel.org/stable/c/ef0c7d4b04a0e6ad175323c24bc84e11470dd79d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/65d35cb555f40529a9edc6bf4beaa3bee917f015","name":"https://git.kernel.org/stable/c/65d35cb555f40529a9edc6bf4beaa3bee917f015","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/0ab8880865f9678eb6174e72c1fc4712e44c745c","name":"https://git.kernel.org/stable/c/0ab8880865f9678eb6174e72c1fc4712e44c745c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e6107a4c74b54cb33e3bce162a63048ae5a6b198","name":"https://git.kernel.org/stable/c/e6107a4c74b54cb33e3bce162a63048ae5a6b198","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72320","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72320","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected aaa31047a6d25da0fa101da1ed544e1247949b40 65d35cb555f40529a9edc6bf4beaa3bee917f015 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected aaa31047a6d25da0fa101da1ed544e1247949b40 0ab8880865f9678eb6174e72c1fc4712e44c745c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected aaa31047a6d25da0fa101da1ed544e1247949b40 238c612357b5a25f03eacf356f95034f8551f218 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected aaa31047a6d25da0fa101da1ed544e1247949b40 ef0c7d4b04a0e6ad175323c24bc84e11470dd79d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected aaa31047a6d25da0fa101da1ed544e1247949b40 e6107a4c74b54cb33e3bce162a63048ae5a6b198 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.13","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.13 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.160 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.97 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.40 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.5 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"72320","cve":"CVE-2026-72320","epss":"0.005230000","percentile":"0.430850000","score_date":"2026-10-16","updated_at":"2026-10-17 00:14:16"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-72320","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T18:46:52.637095Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-16T18:55:17.651Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/netfilter/nft_lookup.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"65d35cb555f40529a9edc6bf4beaa3bee917f015","status":"affected","version":"aaa31047a6d25da0fa101da1ed544e1247949b40","versionType":"git"},{"lessThan":"0ab8880865f9678eb6174e72c1fc4712e44c745c","status":"affected","version":"aaa31047a6d25da0fa101da1ed544e1247949b40","versionType":"git"},{"lessThan":"238c612357b5a25f03eacf356f95034f8551f218","status":"affected","version":"aaa31047a6d25da0fa101da1ed544e1247949b40","versionType":"git"},{"lessThan":"ef0c7d4b04a0e6ad175323c24bc84e11470dd79d","status":"affected","version":"aaa31047a6d25da0fa101da1ed544e1247949b40","versionType":"git"},{"lessThan":"e6107a4c74b54cb33e3bce162a63048ae5a6b198","status":"affected","version":"aaa31047a6d25da0fa101da1ed544e1247949b40","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/netfilter/nft_lookup.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.160","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.97","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.40","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.5","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"5.13","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_lookup: fix catchall element handling with inverted lookups\n\nnft_lookup_eval() decides whether a lookup matched (`found`) from the\ndirect set lookup and priv->invert before falling back to the\ncatchall element used by interval sets (e.g. nft_set_rbtree) for the\nopen-ended default range. Since `found` is never recomputed after\n`ext` is replaced by the catchall lookup, inverted lookups\n(NFT_LOOKUP_F_INV, \"!= @set\") can wrongly match or wrongly skip the\ncatchall element, producing the wrong verdict. Fold the catchall\nlookup into `ext` before computing `found`, matching the order\nalready used by nft_objref_map_eval()."}],"metrics":[{"cvssV3_1":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:N - nft_lookup_eval() runs on the netfilter packet datapath via nft_do_chain() for ingress/forward/prerouting hooks, so a remote sender can reach the bug by sending packets evaluated against an affected inverted lookup rule on a catchall interval set.\nAC:L - Once such a ruleset exists, the attacker reliably controls whether the lookup key hits a set element or the catchall by crafting packet fields; no race, memory layout dependency, or other uncontrollable victim state is required.\nPR:N - Exploitation at runtime only requires sending network traffic through the victim's nftables hooks; although rule installation needs CAP_NET_ADMIN, the remote attacker needs no credentials or local privileges on the target system.\nUI:N - No victim user interaction is needed beyond normal network traffic processing; the kernel automatically evaluates the inverted lookup expression for each matching packet.\nS:U - The impact is incorrect nftables verdicts within the host/kernel network security authority and does not cross VM, container-host, or IOMMU security boundaries.\nC:H - Wrongly matching or skipping the catchall element can bypass intended filtering and expose protected internal services or data that the firewall policy was meant to block from the attacker's network position.\nI:H - The bug can apply or omit catchall set-element actions and verdicts (accept/drop/jump), allowing unauthorized traffic handling contrary to the administrator's intended nftables policy.\nA:N - This is a pure logic error that returns incorrect verdicts without memory corruption, kernel oops/panic, hang, or other direct loss of kernel availability."}]}],"providerMetadata":{"dateUpdated":"2026-10-21T12:44:31.838Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/65d35cb555f40529a9edc6bf4beaa3bee917f015"},{"url":"https://git.kernel.org/stable/c/0ab8880865f9678eb6174e72c1fc4712e44c745c"},{"url":"https://git.kernel.org/stable/c/238c612357b5a25f03eacf356f95034f8551f218"},{"url":"https://git.kernel.org/stable/c/ef0c7d4b04a0e6ad175323c24bc84e11470dd79d"},{"url":"https://git.kernel.org/stable/c/e6107a4c74b54cb33e3bce162a63048ae5a6b198"}],"title":"netfilter: nft_lookup: fix catchall element handling with inverted lookups","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-72320","datePublished":"2026-08-15T05:55:32.939Z","dateReserved":"2026-08-09T03:40:39.919Z","dateUpdated":"2026-10-21T12:44:31.838Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-15 06:22:04","lastModifiedDate":"2026-10-21 13:19:34","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-16T18:46:52.637095Z","id":"CVE-2026-72320","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"72320","Ordinal":"1","Title":"netfilter: nft_lookup: fix catchall element handling with invert","CVE":"CVE-2026-72320","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"72320","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_lookup: fix catchall element handling with inverted lookups\n\nnft_lookup_eval() decides whether a lookup matched (`found`) from the\ndirect set lookup and priv->invert before falling back to the\ncatchall element used by interval sets (e.g. nft_set_rbtree) for the\nopen-ended default range. Since `found` is never recomputed after\n`ext` is replaced by the catchall lookup, inverted lookups\n(NFT_LOOKUP_F_INV, \"!= @set\") can wrongly match or wrongly skip the\ncatchall element, producing the wrong verdict. Fold the catchall\nlookup into `ext` before computing `found`, matching the order\nalready used by nft_objref_map_eval().","Type":"Description","Title":"netfilter: nft_lookup: fix catchall element handling with invert"}]}}}