Answer in brief
CVE-2026-72350 records a Unknown severity vulnerability in netfilter: xt_u32: reject invalid shift counts. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-72350 records a Unknown severity vulnerability in netfilter: xt_u32: reject invalid shift counts. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1b50b8a371e90a5e110f466e4ac02cf6b5f681de <ca7c92d9701249e6daf132087756a88cbf2bb2a3 || >=1b50b8a371e90a5e110f466e4ac02cf6b5f681de <b33b44250d57ab0e5a1e2571b5285fb0d0a7f382 || >=1b50b8a371e90a5e110f466e4ac02cf6b5f681de <728f479dc0447ae7eaef87926ff49142e415a811 || >=1b50b8a371e90a5e110f466e4ac02cf6b5f681de <0a8b7a6d763775709c601f584e709ae48bcc000a || >=1b50b8a371e90a5e110f466e4ac02cf6b5f681de <cce42014415cecd98aa49b3950e7b02ee7c81268 || >=1b50b8a371e90a5e110f466e4ac02cf6b5f681de <a597a722fb71a534138c20359b655726622b5f17 || >=1b50b8a371e90a5e110f466e4ac02cf6b5f681de <00d034fe8230dfc5832fe011ff2d81c1a2cc7a29 || >=1b50b8a371e90a5e110f466e4ac02cf6b5f681de <64cdf7d30ac18e43df6c48004435febb965809a8 | ca7c92d9701249e6daf132087756a88cbf2bb2a3, b33b44250d57ab0e5a1e2571b5285fb0d0a7f382, 728f479dc0447ae7eaef87926ff49142e415a811, 0a8b7a6d763775709c601f584e709ae48bcc000a, cce42014415cecd98aa49b3950e7b02ee7c81268, a597a722fb71a534138c20359b655726622b5f17, 00d034fe8230dfc5832fe011ff2d81c1a2cc7a29, 64cdf7d30ac18e43df6c48004435febb965809a8 |
| Linux/Linuxgeneric | 2.6.23 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_u32: reject invalid shift counts u32_match_it() executes rule-supplied shift operands on a 32-bit value. A malformed u32 rule can provide a shift count of 32 or more, triggering an undefined shift out-of-bounds during packet evaluation. Validate XT_U32_LEFTSH and XT_U32_RIGHTSH operands in u32_mt_checkentry() and reject malformed rules before they reach the packet path.
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1b50b8a371e90a5e110f466e4ac02cf6b5f681de <ca7c92d9701249e6daf132087756a88cbf2bb2a3 || >=1b50b8a371e90a5e110f466e4ac02cf6b5f681de <b33b44250d57ab0e5a1e2571b5285fb0d0a7f382 || >=1b50b8a371e90a5e110f466e4ac02cf6b5f681de <728f479dc0447ae7eaef87926ff49142e415a811 || >=1b50b8a371e90a5e110f466e4ac02cf6b5f681de <0a8b7a6d763775709c601f584e709ae48bcc000a || >=1b50b8a371e90a5e110f466e4ac02cf6b5f681de <cce42014415cecd98aa49b3950e7b02ee7c81268 || >=1b50b8a371e90a5e110f466e4ac02cf6b5f681de <a597a722fb71a534138c20359b655726622b5f17 || >=1b50b8a371e90a5e110f466e4ac02cf6b5f681de <00d034fe8230dfc5832fe011ff2d81c1a2cc7a29 || >=1b50b8a371e90a5e110f466e4ac02cf6b5f681de <64cdf7d30ac18e43df6c48004435febb965809a8 | ca7c92d9701249e6daf132087756a88cbf2bb2a3, b33b44250d57ab0e5a1e2571b5285fb0d0a7f382, 728f479dc0447ae7eaef87926ff49142e415a811, 0a8b7a6d763775709c601f584e709ae48bcc000a, cce42014415cecd98aa49b3950e7b02ee7c81268, a597a722fb71a534138c20359b655726622b5f17, 00d034fe8230dfc5832fe011ff2d81c1a2cc7a29, 64cdf7d30ac18e43df6c48004435febb965809a8 |
| Linux/Linuxgeneric | 2.6.23 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_u32: reject invalid shift counts u32_match_it() executes rule-supplied shift operands on a 32-bit value. A malformed u32 rule can provide a shift count of 32 or more, triggering an undefined shift out-of-bounds during packet evaluation. Validate XT_U32_LEFTSH and XT_U32_RIGHTSH operands in u32_mt_checkentry() and reject malformed rules before they reach the packet path.
Quoted source text, attributed separately from HOL analysis.