CVE-2026-99285
Description
A flaw was found in the Linux kernel's Netfilter network packet filtering framework. When handling 64-bit byte-order conversions across multiple data registers, an offset calculation error causes the kernel to advance through source registers incorrectly. A local attacker with network administration privileges can exploit this flaw by loading specially crafted firewall rules, potentially leading to memory corruption or a system crash, resulting in a Denial of Service (DoS).
Statement
This vulnerability is rated as Moderate because exploitation requires local access with administrative privileges (specifically CAP_NET_ADMIN) to manipulate nftables rules. In default Red Hat Enterprise Linux configurations, standard users cannot inject custom netfilter expressions unless unprivileged user namespaces are specifically configured or permitted. While an attacker with sufficient permissions could cause kernel memory corruption or a denial of service via malformed multi-register byte-order conversions, the risk is contained locally and cannot be triggered remotely.
Mitigation
To mitigate this vulnerability, prevent unprivileged local users from gaining administrative capabilities to configure nftables rules via user namespaces:
1. Disable unprivileged user namespaces by configuring sysctl:
# echo "user.max_user_namespaces=0" > /etc/sysctl.d/99-userns.conf
# sysctl -p /etc/sysctl.d/99-userns.conf
Caveats: Disabling user namespaces prevents rootless containers (such as rootless Podman) and containerized sandboxes from operating.
Additionally, if packet filtering is not required on the system, prevent the nf_tables kernel module from loading:
# echo "install nf_tables /bin/true" > /etc/modprobe.d/disable-nf_tables.conf
Caveats: Disabling nf_tables prevents nftables and dependent firewall services (such as firewalld) from running. If the module is already loaded into kernel memory, a system restart is required for the configuration to take effect.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
