CVE-2026-52920

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-52920", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.367Z", "datePublished": "2026-06-24T07:14:15.866Z", "dateUpdated": "2026-10-19T19:37:00.676Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:31:42.384Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_policy: fix strict mode inbound policy matching\n\nmatch_policy_in() walks sec_path entries from the last transform to the\nfirst one, but strict policy matching needs to consume info->pol[] in\nthe same forward order as the rule layout.\n\nDerive the strict-match policy position from the number of transforms\nalready consumed so that multi-element inbound rules are matched\nconsistently."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "baseScore": 8.3, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable matcher is executed while processing inbound IPv4/IPv6 packets through x_tables after XFRM/IPsec has populated the packet sec_path. A remote IPsec peer can trigger the affected strict inbound policy rule by sending network packets in a realistic VPN/gateway deployment.\nAC:L - Exploitation requires a strict inbound xt_policy rule with multiple policy elements and a packet with the same number of transforms, but those are normal affected configurations rather than attacker-uncontrolled races. Once present, triggering is repeatable by sending matching packets.\nPR:L - Unauthenticated packets generally fail XFRM state/authentication before reaching this sec_path-based match, so the network scenario requires an authorized IPsec peer or equivalent low privilege. Locally, the rule/XFRM setup is gated by CAP_NET_ADMIN in the network namespace, which is reachable through user namespaces.\nUI:N - No victim user action is needed after the vulnerable rule/state configuration exists. Packet delivery or local namespace traffic is sufficient to invoke the matcher.\nS:U - The bug is in kernel netfilter/XFRM policy evaluation and impacts the same kernel/network security authority. It does not cross a VM, IOMMU, or separate sandbox security scope.\nC:H - The old strict inbound index calculation can make pos negative and read before info->pol[], including x_tables rule metadata or adjacent kernel allocation contents. Although exposed through match behavior rather than a direct copy_to_user, this is an out-of-bounds kernel read larger than a few bytes, so the higher confidentiality impact is warranted.\nI:L - The bug does not provide a direct write primitive or code execution path, but it can make strict IPsec policy matching produce incorrect firewall decisions. That can bypass or misapply intended packet filtering for affected multi-element inbound rules.\nA:H - The negative-index read can reach outside the intended match data and, for larger strict transform counts or unlucky layout, may fault/oops in kernel packet processing. The condition can be triggered repeatedly with packets once the affected rule path is reachable."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/xt_policy.c"], "versions": [{"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "lessThan": "eb323f7b82d2e2f638de0cc2a177803eb20e0707", "status": "affected", "versionType": "git"}, {"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "lessThan": "fc1c518bb1f054831ecabb32da9b8e1dff9699c6", "status": "affected", "versionType": "git"}, {"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "lessThan": "f98b7f85e04b40e28b08c461ded0cc79f14f5509", "status": "affected", "versionType": "git"}, {"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "lessThan": "82664d0f1ba25e4f9a71994954abae24c60f4067", "status": "affected", "versionType": "git"}, {"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "lessThan": "b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9", "status": "affected", "versionType": "git"}, {"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "lessThan": "938867e870fb5471bb16f442aeac81326e05bf65", "status": "affected", "versionType": "git"}, {"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "lessThan": "392cc1d8408b5665215c1e9290bbf0f92339b043", "status": "affected", "versionType": "git"}, {"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "lessThan": "4b2b4d7d4e203c92db8966b163edfacb1f0e1e29", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/xt_policy.c"], "versions": [{"version": "2.6.17", "status": "affected"}, {"version": "0", "lessThan": "2.6.17", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.141", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.91", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.33", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.17", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.17", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.17", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.17", "versionEndExcluding": "6.6.141"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.17", "versionEndExcluding": "6.12.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.17", "versionEndExcluding": "6.18.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.17", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.17", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/eb323f7b82d2e2f638de0cc2a177803eb20e0707"}, {"url": "https://git.kernel.org/stable/c/fc1c518bb1f054831ecabb32da9b8e1dff9699c6"}, {"url": "https://git.kernel.org/stable/c/f98b7f85e04b40e28b08c461ded0cc79f14f5509"}, {"url": "https://git.kernel.org/stable/c/82664d0f1ba25e4f9a71994954abae24c60f4067"}, {"url": "https://git.kernel.org/stable/c/b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9"}, {"url": "https://git.kernel.org/stable/c/938867e870fb5471bb16f442aeac81326e05bf65"}, {"url": "https://git.kernel.org/stable/c/392cc1d8408b5665215c1e9290bbf0f92339b043"}, {"url": "https://git.kernel.org/stable/c/4b2b4d7d4e203c92db8966b163edfacb1f0e1e29"}], "title": "netfilter: xt_policy: fix strict mode inbound policy matching", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-52920", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:22:43.940602Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-682", "description": "CWE-682 Incorrect Calculation"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:37:00.676Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-52920", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:22:43.940602Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-682", "description": "CWE-682 Incorrect Calculation"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:22:44.526Z"}}], "cna": {"title": "netfilter: xt_policy: fix strict mode inbound policy matching", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable matcher is executed while processing inbound IPv4/IPv6 packets through x_tables after XFRM/IPsec has populated the packet sec_path. A remote IPsec peer can trigger the affected strict inbound policy rule by sending network packets in a realistic VPN/gateway deployment.\nAC:L - Exploitation requires a strict inbound xt_policy rule with multiple policy elements and a packet with the same number of transforms, but those are normal affected configurations rather than attacker-uncontrolled races. Once present, triggering is repeatable by sending matching packets.\nPR:L - Unauthenticated packets generally fail XFRM state/authentication before reaching this sec_path-based match, so the network scenario requires an authorized IPsec peer or equivalent low privilege. Locally, the rule/XFRM setup is gated by CAP_NET_ADMIN in the network namespace, which is reachable through user namespaces.\nUI:N - No victim user action is needed after the vulnerable rule/state configuration exists. Packet delivery or local namespace traffic is sufficient to invoke the matcher.\nS:U - The bug is in kernel netfilter/XFRM policy evaluation and impacts the same kernel/network security authority. It does not cross a VM, IOMMU, or separate sandbox security scope.\nC:H - The old strict inbound index calculation can make pos negative and read before info->pol[], including x_tables rule metadata or adjacent kernel allocation contents. Although exposed through match behavior rather than a direct copy_to_user, this is an out-of-bounds kernel read larger than a few bytes, so the higher confidentiality impact is warranted.\nI:L - The bug does not provide a direct write primitive or code execution path, but it can make strict IPsec policy matching produce incorrect firewall decisions. That can bypass or misapply intended packet filtering for affected multi-element inbound rules.\nA:H - The negative-index read can reach outside the intended match data and, for larger strict transform counts or unlucky layout, may fault/oops in kernel packet processing. The condition can be triggered repeatedly with packets once the affected rule path is reachable."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "lessThan": "eb323f7b82d2e2f638de0cc2a177803eb20e0707", "versionType": "git"}, {"status": "affected", "version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "lessThan": "fc1c518bb1f054831ecabb32da9b8e1dff9699c6", "versionType": "git"}, {"status": "affected", "version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "lessThan": "f98b7f85e04b40e28b08c461ded0cc79f14f5509", "versionType": "git"}, {"status": "affected", "version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "lessThan": "82664d0f1ba25e4f9a71994954abae24c60f4067", "versionType": "git"}, {"status": "affected", "version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "lessThan": "b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9", "versionType": "git"}, {"status": "affected", "version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "lessThan": "938867e870fb5471bb16f442aeac81326e05bf65", "versionType": "git"}, {"status": "affected", "version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "lessThan": "392cc1d8408b5665215c1e9290bbf0f92339b043", "versionType": "git"}, {"status": "affected", "version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "lessThan": "4b2b4d7d4e203c92db8966b163edfacb1f0e1e29", "versionType": "git"}], "programFiles": ["net/netfilter/xt_policy.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.17"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.17", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.258", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.209", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.175", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.141", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.91", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.33", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.10", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/netfilter/xt_policy.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/eb323f7b82d2e2f638de0cc2a177803eb20e0707"}, {"url": "https://git.kernel.org/stable/c/fc1c518bb1f054831ecabb32da9b8e1dff9699c6"}, {"url": "https://git.kernel.org/stable/c/f98b7f85e04b40e28b08c461ded0cc79f14f5509"}, {"url": "https://git.kernel.org/stable/c/82664d0f1ba25e4f9a71994954abae24c60f4067"}, {"url": "https://git.kernel.org/stable/c/b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9"}, {"url": "https://git.kernel.org/stable/c/938867e870fb5471bb16f442aeac81326e05bf65"}, {"url": "https://git.kernel.org/stable/c/392cc1d8408b5665215c1e9290bbf0f92339b043"}, {"url": "https://git.kernel.org/stable/c/4b2b4d7d4e203c92db8966b163edfacb1f0e1e29"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_policy: fix strict mode inbound policy matching\n\nmatch_policy_in() walks sec_path entries from the last transform to the\nfirst one, but strict policy matching needs to consume info->pol[] in\nthe same forward order as the rule layout.\n\nDerive the strict-match policy position from the number of transforms\nalready consumed so that multi-element inbound rules are matched\nconsistently."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.258", "versionStartIncluding": "2.6.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.209", "versionStartIncluding": "2.6.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.175", "versionStartIncluding": "2.6.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.141", "versionStartIncluding": "2.6.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.91", "versionStartIncluding": "2.6.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.33", "versionStartIncluding": "2.6.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.10", "versionStartIncluding": "2.6.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "2.6.17"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:31:42.384Z"}}}, "cveMetadata": {"cveId": "CVE-2026-52920", "state": "PUBLISHED", "dateUpdated": "2026-10-19T19:37:00.676Z", "dateReserved": "2026-06-09T07:44:35.367Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-06-24T07:14:15.866Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/netfilter/xt_policy.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "eb323f7b82d2e2f638de0cc2a177803eb20e0707", "status": "affected", "version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "versionType": "git"}, {"lessThan": "fc1c518bb1f054831ecabb32da9b8e1dff9699c6", "status": "affected", "version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "versionType": "git"}, {"lessThan": "f98b7f85e04b40e28b08c461ded0cc79f14f5509", "status": "affected", "version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "versionType": "git"}, {"lessThan": "82664d0f1ba25e4f9a71994954abae24c60f4067", "status": "affected", "version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "versionType": "git"}, {"lessThan": "b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9", "status": "affected", "version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "versionType": "git"}, {"lessThan": "938867e870fb5471bb16f442aeac81326e05bf65", "status": "affected", "version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "versionType": "git"}, {"lessThan": "392cc1d8408b5665215c1e9290bbf0f92339b043", "status": "affected", "version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "versionType": "git"}, {"lessThan": "4b2b4d7d4e203c92db8966b163edfacb1f0e1e29", "status": "affected", "version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/netfilter/xt_policy.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.17"}, {"lessThan": "2.6.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.258", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.141", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.91", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.33", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "412F45FE-23AA-4172-854C-E4F795059C6B", "versionEndExcluding": "5.10.258", "versionStartIncluding": "2.6.17", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "919C10A9-7951-4A74-BADD-C135A0A8D8B4", "versionEndExcluding": "5.15.209", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA", "versionEndExcluding": "6.1.175", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "97A9FFFA-22BB-4D5C-9790-5A2286E392F7", "versionEndExcluding": "6.6.141", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C918746B-DE6F-448F-A93E-A04C5481688D", "versionEndExcluding": "6.12.91", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "96D99E49-380D-43AB-BDBA-25C3AD018A9C", "versionEndExcluding": "6.18.33", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A13475D2-59BF-4716-94B5-7C1D239A2CF4", "versionEndExcluding": "7.0.10", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_policy: fix strict mode inbound policy matching\n\nmatch_policy_in() walks sec_path entries from the last transform to the\nfirst one, but strict policy matching needs to consume info->pol[] in\nthe same forward order as the rule layout.\n\nDerive the strict-match policy position from the number of transforms\nalready consumed so that multi-element inbound rules are matched\nconsistently."}], "id": "CVE-2026-52920", "lastModified": "2026-10-19T20:18:46.707", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.5, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-52920", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:22:43.940602Z", "version": "2.0.3"}}]}, "published": "2026-06-24T08:16:21.950", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/392cc1d8408b5665215c1e9290bbf0f92339b043"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4b2b4d7d4e203c92db8966b163edfacb1f0e1e29"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/82664d0f1ba25e4f9a71994954abae24c60f4067"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/938867e870fb5471bb16f442aeac81326e05bf65"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/eb323f7b82d2e2f638de0cc2a177803eb20e0707"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f98b7f85e04b40e28b08c461ded0cc79f14f5509"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fc1c518bb1f054831ecabb32da9b8e1dff9699c6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-682"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: netfilter: xt_policy: fix strict mode inbound policy matching", "id": "2492112", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492112"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-551", "details": ["A flaw was found in the Linux kernel's netfilter component, which is responsible for network packet filtering. This vulnerability, located in the `xt_policy` module, involves an error in how strict inbound network policies are matched. This could allow an attacker to bypass established security rules, potentially leading to unauthorized network access or unintended exposure of services. The flaw could compromise the effectiveness of network traffic control."], "name": "CVE-2026-52920", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-52920\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-52920\nhttps://lore.kernel.org/linux-cve-announce/2026062430-CVE-2026-52920-22f8@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c4b885139203d37f76662c37ae645fe8e0f4e4e5,eb323f7b82d2e2f638de0cc2a177803eb20e0707)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c4b885139203d37f76662c37ae645fe8e0f4e4e5,fc1c518bb1f054831ecabb32da9b8e1dff9699c6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c4b885139203d37f76662c37ae645fe8e0f4e4e5,f98b7f85e04b40e28b08c461ded0cc79f14f5509)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c4b885139203d37f76662c37ae645fe8e0f4e4e5,82664d0f1ba25e4f9a71994954abae24c60f4067)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c4b885139203d37f76662c37ae645fe8e0f4e4e5,b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c4b885139203d37f76662c37ae645fe8e0f4e4e5,938867e870fb5471bb16f442aeac81326e05bf65)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c4b885139203d37f76662c37ae645fe8e0f4e4e5,392cc1d8408b5665215c1e9290bbf0f92339b043)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c4b885139203d37f76662c37ae645fe8e0f4e4e5,4b2b4d7d4e203c92db8966b163edfacb1f0e1e29)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.258,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.209,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.175,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.141,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.91,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.33,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.10,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-24T13:45:16.878235+00:00", "updated": "2026-10-23T00:45:13.620528+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}