Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-11-10T17:37:13 kernel: kernel: Memory corruption via multi-register byteorder conversion in netfilter 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-787

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_byteorder: remove multi-register support 64bit byteorder conversion is broken when several registers need to be converted because the source register array advances in steps for 4 bytes instead of 8: for (i = ... src64 = nft_reg_load64(&src[i]); ~~~~~ u32 *src nft_reg_store64(&dst64[i], Remove the multi-register support, it has other issues as well: Pablo points out that commit caf3ef7468f7 ("netfilter: nf_tables: prevent OOB access in nft_byteorder_eval") alters semantics: before the loop operated on registers, i.e. for ( ... ) dst32[i] = htons((u16)src32[i]) .. but after the patch it will operate on bytes, which makes this useless to convert e.g. concatenations, which store each compound in its own register. Multi-convert of u32 has one theoretical application: ct mark . meta mark . tcp dport @intervalset Because ct mark and meta mark are host byte order, use with intervals has to convert the byteorder for ct/meta mark value to network byte order (bigendian). nftables emits this: [ meta load mark => reg 1 ] [ byteorder reg 1 = hton(reg 1, 4, 4) ] [ ct load mark => reg 9 ] [ byteorder reg 9 = hton(reg 9, 4, 4) ] ... I.e. two separate calls. Theoretically it could be changed to do: [ meta load mark => reg 1 ] [ ct load mark => reg 9 ] [ byteorder reg 1 = htonl(reg 1, 4, 8) ] ... But then all it would take to change the set to meta mark . tcp dport . ct mark ... and we'd be back to two "byteorder" calls. IOW, support to convert a range of registers is both dysfunctional and dubious. Simplify this: remove the feature. Pablo Neira Ayuso points out that nftables before 1.1.0 can generate incorrect byteorder conversions, see 9fe58952c45a, "evaluate: skip byteorder conversion for selector smaller than 2 bytes" in nftables.git). Affected rulesets fail to load with this change and old userspace due to 'len != size' check.

A flaw was found in the Linux kernel's Netfilter network packet filtering framework. When handling 64-bit byte-order conversions across multiple data registers, an offset calculation error causes the kernel to advance through source registers incorrectly. A local attacker with network administration privileges can exploit this flaw by loading specially crafted firewall rules, potentially leading to memory corruption or a system crash, resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate because exploitation requires local access with administrative privileges (specifically CAP_NET_ADMIN) to manipulate nftables rules. In default Red Hat Enterprise Linux configurations, standard users cannot inject custom netfilter expressions unless unprivileged user namespaces are specifically configured or permitted. While an attacker with sufficient permissions could cause kernel memory corruption or a denial of service via malformed multi-register byte-order conversions, the risk is contained locally and cannot be triggered remotely. To mitigate this vulnerability, prevent unprivileged local users from gaining administrative capabilities to configure nftables rules via user namespaces: 1. Disable unprivileged user namespaces by configuring sysctl: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/99-userns.conf # sysctl -p /etc/sysctl.d/99-userns.conf Caveats: Disabling user namespaces prevents rootless containers (such as rootless Podman) and containerized sandboxes from operating. Additionally, if packet filtering is not required on the system, prevent the nf_tables kernel module from loading: # echo "install nf_tables /bin/true" > /etc/modprobe.d/disable-nf_tables.conf Caveats: Disabling nf_tables prevents nftables and dependent firewall services (such as firewalld) from running. If the module is already loaded into kernel memory, a system restart is required for the configuration to take effect. Red Hat Enterprise Linux 10 Fix deferred kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Fix deferred kernel Red Hat Enterprise Linux 9 Not affected kernel-rt Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Fix deferred openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 Fix deferred openshift/ose-rhel-coreos-10 Red Hat OpenShift Container Platform 5 Fix deferred openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-99285 https://nvd.nist.gov/vuln/detail/CVE-2026-99285 https://git.kernel.org/stable/c/3c5fb3a6c8118d15e60295e76fb5b879021eef43 https://git.kernel.org/stable/c/bb061d3de41707415269be75ebf700efb03ec212 https://git.kernel.org/stable/c/dc29c0478b8564feb9371e715b5a0016eb8903fd