Answer in brief
CVE-2026-72436 records a Unknown severity vulnerability in netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-72436 records a Unknown severity vulnerability in netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=18f84d41d34fa35d0d64bbaea01fe664553ecc06 <c107233d2ff4fd7cef5d02f9124b99194957a710 || >=18f84d41d34fa35d0d64bbaea01fe664553ecc06 <6329d3a9afe715fddda0460cfa46b496d61c2fe0 || >=18f84d41d34fa35d0d64bbaea01fe664553ecc06 <7445fe965b7d8756070a40e80f8b73348ccda1d7 || >=18f84d41d34fa35d0d64bbaea01fe664553ecc06 <c4d257734e91bfcdc71d41843392dd6400b5bb1b || >=18f84d41d34fa35d0d64bbaea01fe664553ecc06 <3219d74e4536658c937fd878a327257b86ce80dd || >=18f84d41d34fa35d0d64bbaea01fe664553ecc06 <e4b4984e28c16406ecb318444dea4a8bf47def3e | c107233d2ff4fd7cef5d02f9124b99194957a710, 6329d3a9afe715fddda0460cfa46b496d61c2fe0, 7445fe965b7d8756070a40e80f8b73348ccda1d7, c4d257734e91bfcdc71d41843392dd6400b5bb1b, 3219d74e4536658c937fd878a327257b86ce80dd, e4b4984e28c16406ecb318444dea4a8bf47def3e |
| Linux/Linuxgeneric | 4.2 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types Sashiko pointed out that there are a few lockless RCU readers using test_bit() which is a relaxed atomic operation and provides no memory barrier guarantees. Use test_bit_acquire() instead where the operation may run parallel with add/del/gc, i.e. is not one from the next cases - protected by region lock - in a set destroy phase - in a new/temporary set creation phase
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=18f84d41d34fa35d0d64bbaea01fe664553ecc06 <c107233d2ff4fd7cef5d02f9124b99194957a710 || >=18f84d41d34fa35d0d64bbaea01fe664553ecc06 <6329d3a9afe715fddda0460cfa46b496d61c2fe0 || >=18f84d41d34fa35d0d64bbaea01fe664553ecc06 <7445fe965b7d8756070a40e80f8b73348ccda1d7 || >=18f84d41d34fa35d0d64bbaea01fe664553ecc06 <c4d257734e91bfcdc71d41843392dd6400b5bb1b || >=18f84d41d34fa35d0d64bbaea01fe664553ecc06 <3219d74e4536658c937fd878a327257b86ce80dd || >=18f84d41d34fa35d0d64bbaea01fe664553ecc06 <e4b4984e28c16406ecb318444dea4a8bf47def3e | c107233d2ff4fd7cef5d02f9124b99194957a710, 6329d3a9afe715fddda0460cfa46b496d61c2fe0, 7445fe965b7d8756070a40e80f8b73348ccda1d7, c4d257734e91bfcdc71d41843392dd6400b5bb1b, 3219d74e4536658c937fd878a327257b86ce80dd, e4b4984e28c16406ecb318444dea4a8bf47def3e |
| Linux/Linuxgeneric | 4.2 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types Sashiko pointed out that there are a few lockless RCU readers using test_bit() which is a relaxed atomic operation and provides no memory barrier guarantees. Use test_bit_acquire() instead where the operation may run parallel with add/del/gc, i.e. is not one from the next cases - protected by region lock - in a set destroy phase - in a new/temporary set creation phase
Quoted source text, attributed separately from HOL analysis.