CVE-2026-99285

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99285", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.405Z", "datePublished": "2026-11-10T17:37:13.348Z", "dateUpdated": "2026-11-10T17:37:13.348Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-10T17:37:13.348Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_byteorder: remove multi-register support\n\n64bit byteorder conversion is broken when several registers need to be\nconverted because the source register array advances in steps for 4 bytes\ninstead of 8:\n\n for (i = ...\n src64 = nft_reg_load64(&src[i]);\n ~~~~~ u32 *src\n nft_reg_store64(&dst64[i],\n\nRemove the multi-register support, it has other issues as well:\n\nPablo points out that commit\ncaf3ef7468f7 (\"netfilter: nf_tables: prevent OOB access in nft_byteorder_eval\")\nalters semantics: before the loop operated on registers, i.e.\n for ( ... )\n dst32[i] = htons((u16)src32[i])\n\n .. but after the patch it will operate on bytes, which makes this\n useless to convert e.g. concatenations, which store each compound\n in its own register.\n\nMulti-convert of u32 has one theoretical application:\n\nct mark . meta mark . tcp dport @intervalset\n\nBecause ct mark and meta mark are host byte order, use with\nintervals has to convert the byteorder for ct/meta mark value\nto network byte order (bigendian).\n\nnftables emits this:\n [ meta load mark => reg 1 ]\n [ byteorder reg 1 = hton(reg 1, 4, 4) ]\n [ ct load mark => reg 9 ]\n [ byteorder reg 9 = hton(reg 9, 4, 4) ]\n ...\n\nI.e. two separate calls. Theoretically it could be changed to do:\n [ meta load mark => reg 1 ]\n [ ct load mark => reg 9 ]\n [ byteorder reg 1 = htonl(reg 1, 4, 8) ]\n ...\n\nBut then all it would take to change the set to\nmeta mark . tcp dport . ct mark\n\n... and we'd be back to two \"byteorder\" calls. IOW, support to\nconvert a range of registers is both dysfunctional and dubious.\n\nSimplify this: remove the feature.\n\nPablo Neira Ayuso points out that nftables before 1.1.0 can generate\nincorrect byteorder conversions, see 9fe58952c45a,\n\"evaluate: skip byteorder conversion for selector smaller than 2 bytes\"\nin nftables.git). Affected rulesets fail to load with this change and\nold userspace due to 'len != size' check."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nft_byteorder.c"], "versions": [{"version": "c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63", "lessThan": "3c5fb3a6c8118d15e60295e76fb5b879021eef43", "status": "affected", "versionType": "git"}, {"version": "c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63", "lessThan": "dc29c0478b8564feb9371e715b5a0016eb8903fd", "status": "affected", "versionType": "git"}, {"version": "c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63", "lessThan": "bb061d3de41707415269be75ebf700efb03ec212", "status": "affected", "versionType": "git"}, {"version": "fca41e5b687e029f69e3a35a2fa31e2560e538dc", "status": "affected", "versionType": "git"}, {"version": "25b42be4e067e107a2559266b54bf07fa5b094fb", "status": "affected", "versionType": "git"}, {"version": "9a865a11d6890d4a789db1eaafebdc8bd092b12c", "status": "affected", "versionType": "git"}, {"version": "b8b514b2a6cdfac24911e4910461bcb9db15ca8d", "status": "affected", "versionType": "git"}, {"version": "18a169810cff769a7a697b35058c756805f589e0", "status": "affected", "versionType": "git"}, {"version": "1a605657adc58b3c8e2c1c66aaa5fecd29072135", "status": "affected", "versionType": "git"}, {"version": "013deed31ab15ef287b0045e4e7bd8f250e75b94", "status": "affected", "versionType": "git"}, {"version": "4.19.307", "lessThan": "4.20", "status": "affected", "versionType": "semver"}, {"version": "5.4.269", "lessThan": "5.5", "status": "affected", "versionType": "semver"}, {"version": "5.10.210", "lessThan": "5.11", "status": "affected", "versionType": "semver"}, {"version": "5.15.140", "lessThan": "5.16", "status": "affected", "versionType": "semver"}, {"version": "6.1.64", "lessThan": "6.2", "status": "affected", "versionType": "semver"}, {"version": "6.5.13", "lessThan": "6.6", "status": "affected", "versionType": "semver"}, {"version": "6.6.3", "lessThan": "6.7", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nft_byteorder.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.59", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.18.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "7.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.307"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.269"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.140"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3c5fb3a6c8118d15e60295e76fb5b879021eef43"}, {"url": "https://git.kernel.org/stable/c/dc29c0478b8564feb9371e715b5a0016eb8903fd"}, {"url": "https://git.kernel.org/stable/c/bb061d3de41707415269be75ebf700efb03ec212"}], "title": "netfilter: nft_byteorder: remove multi-register support", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/netfilter/nft_byteorder.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3c5fb3a6c8118d15e60295e76fb5b879021eef43", "status": "affected", "version": "c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63", "versionType": "git"}, {"lessThan": "dc29c0478b8564feb9371e715b5a0016eb8903fd", "status": "affected", "version": "c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63", "versionType": "git"}, {"lessThan": "bb061d3de41707415269be75ebf700efb03ec212", "status": "affected", "version": "c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63", "versionType": "git"}, {"status": "affected", "version": "fca41e5b687e029f69e3a35a2fa31e2560e538dc", "versionType": "git"}, {"status": "affected", "version": "25b42be4e067e107a2559266b54bf07fa5b094fb", "versionType": "git"}, {"status": "affected", "version": "9a865a11d6890d4a789db1eaafebdc8bd092b12c", "versionType": "git"}, {"status": "affected", "version": "b8b514b2a6cdfac24911e4910461bcb9db15ca8d", "versionType": "git"}, {"status": "affected", "version": "18a169810cff769a7a697b35058c756805f589e0", "versionType": "git"}, {"status": "affected", "version": "1a605657adc58b3c8e2c1c66aaa5fecd29072135", "versionType": "git"}, {"status": "affected", "version": "013deed31ab15ef287b0045e4e7bd8f250e75b94", "versionType": "git"}, {"lessThan": "4.20", "status": "affected", "version": "4.19.307", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.269", "versionType": "semver"}, {"lessThan": "5.11", "status": "affected", "version": "5.10.210", "versionType": "semver"}, {"lessThan": "5.16", "status": "affected", "version": "5.15.140", "versionType": "semver"}, {"lessThan": "6.2", "status": "affected", "version": "6.1.64", "versionType": "semver"}, {"lessThan": "6.6", "status": "affected", "version": "6.5.13", "versionType": "semver"}, {"lessThan": "6.7", "status": "affected", "version": "6.6.3", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/netfilter/nft_byteorder.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.59", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_byteorder: remove multi-register support\n\n64bit byteorder conversion is broken when several registers need to be\nconverted because the source register array advances in steps for 4 bytes\ninstead of 8:\n\n for (i = ...\n src64 = nft_reg_load64(&src[i]);\n ~~~~~ u32 *src\n nft_reg_store64(&dst64[i],\n\nRemove the multi-register support, it has other issues as well:\n\nPablo points out that commit\ncaf3ef7468f7 (\"netfilter: nf_tables: prevent OOB access in nft_byteorder_eval\")\nalters semantics: before the loop operated on registers, i.e.\n for ( ... )\n dst32[i] = htons((u16)src32[i])\n\n .. but after the patch it will operate on bytes, which makes this\n useless to convert e.g. concatenations, which store each compound\n in its own register.\n\nMulti-convert of u32 has one theoretical application:\n\nct mark . meta mark . tcp dport @intervalset\n\nBecause ct mark and meta mark are host byte order, use with\nintervals has to convert the byteorder for ct/meta mark value\nto network byte order (bigendian).\n\nnftables emits this:\n [ meta load mark => reg 1 ]\n [ byteorder reg 1 = hton(reg 1, 4, 4) ]\n [ ct load mark => reg 9 ]\n [ byteorder reg 9 = hton(reg 9, 4, 4) ]\n ...\n\nI.e. two separate calls. Theoretically it could be changed to do:\n [ meta load mark => reg 1 ]\n [ ct load mark => reg 9 ]\n [ byteorder reg 1 = htonl(reg 1, 4, 8) ]\n ...\n\nBut then all it would take to change the set to\nmeta mark . tcp dport . ct mark\n\n... and we'd be back to two \"byteorder\" calls. IOW, support to\nconvert a range of registers is both dysfunctional and dubious.\n\nSimplify this: remove the feature.\n\nPablo Neira Ayuso points out that nftables before 1.1.0 can generate\nincorrect byteorder conversions, see 9fe58952c45a,\n\"evaluate: skip byteorder conversion for selector smaller than 2 bytes\"\nin nftables.git). Affected rulesets fail to load with this change and\nold userspace due to 'len != size' check."}], "id": "CVE-2026-99285", "lastModified": "2026-11-10T18:17:49.147", "metrics": {}, "published": "2026-11-10T18:17:49.147", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3c5fb3a6c8118d15e60295e76fb5b879021eef43"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bb061d3de41707415269be75ebf700efb03ec212"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dc29c0478b8564feb9371e715b5a0016eb8903fd"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Memory corruption via multi-register byteorder conversion in netfilter", "id": "2571048", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571048"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in the Linux kernel's Netfilter network packet filtering framework. When handling 64-bit byte-order conversions across multiple data registers, an offset calculation error causes the kernel to advance through source registers incorrectly. A local attacker with network administration privileges can exploit this flaw by loading specially crafted firewall rules, potentially leading to memory corruption or a system crash, resulting in a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, prevent unprivileged local users from gaining administrative capabilities to configure nftables rules via user namespaces:\n1. Disable unprivileged user namespaces by configuring sysctl:\n# echo \"user.max_user_namespaces=0\" > /etc/sysctl.d/99-userns.conf\n# sysctl -p /etc/sysctl.d/99-userns.conf\nCaveats: Disabling user namespaces prevents rootless containers (such as rootless Podman) and containerized sandboxes from operating.\nAdditionally, if packet filtering is not required on the system, prevent the nf_tables kernel module from loading:\n# echo \"install nf_tables /bin/true\" > /etc/modprobe.d/disable-nf_tables.conf\nCaveats: Disabling nf_tables prevents nftables and dependent firewall services (such as firewalld) from running. If the module is already loaded into kernel memory, a system restart is required for the configuration to take effect."}, "name": "CVE-2026-99285", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-11-10T17:37:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99285\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99285\nhttps://git.kernel.org/stable/c/3c5fb3a6c8118d15e60295e76fb5b879021eef43\nhttps://git.kernel.org/stable/c/bb061d3de41707415269be75ebf700efb03ec212\nhttps://git.kernel.org/stable/c/dc29c0478b8564feb9371e715b5a0016eb8903fd"], "statement": "This vulnerability is rated as Moderate because exploitation requires local access with administrative privileges (specifically CAP_NET_ADMIN) to manipulate nftables rules. In default Red Hat Enterprise Linux configurations, standard users cannot inject custom netfilter expressions unless unprivileged user namespaces are specifically configured or permitted. While an attacker with sufficient permissions could cause kernel memory corruption or a denial of service via malformed multi-register byte-order conversions, the risk is contained locally and cannot be triggered remotely.", "threat_severity": "Moderate"}

{}