Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-15T00:00:00 kernel: netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-821

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types Sashiko pointed out that there are a few lockless RCU readers using test_bit() which is a relaxed atomic operation and provides no memory barrier guarantees. Use test_bit_acquire() instead where the operation may run parallel with add/del/gc, i.e. is not one from the next cases - protected by region lock - in a set destroy phase - in a new/temporary set creation phase

A flaw was found in the `netfilter: ipset` component of the Linux kernel. This vulnerability occurs because a specific operation, `test_bit()`, is used in a way that lacks proper safeguards when multiple processes access shared data simultaneously. This can lead to situations where the system processes data incorrectly or behaves unexpectedly. Such issues could potentially result in data corruption or make the system unavailable (Denial of Service).

Red Hat Enterprise Linux 10 Affected kernel Red Hat Enterprise Linux 6 Out of support scope kernel Red Hat Enterprise Linux 7 Affected kernel Red Hat Enterprise Linux 7 Affected kernel-rt Red Hat Enterprise Linux 8 Affected kernel Red Hat Enterprise Linux 8 Affected kernel-rt Red Hat Enterprise Linux 9 Affected kernel Red Hat Enterprise Linux 9 Affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-72436 https://nvd.nist.gov/vuln/detail/CVE-2026-72436 https://lore.kernel.org/linux-cve-announce/2026081528-CVE-2026-72436-eb00@gregkh/T