CVE-2026-74579

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_payload: fix mask build for partial field offload

nft_payload_offload_mask() builds the offload match mask for a payload

expression that covers only part of a header field. For a partial IPv6

address match (field_len = 16, priv_len = 1) that shift is 1 << 120, which

is undefined on the 32-bit int operand. It also trims only one word, so

the remaining words stay 0xffffffff (and when priv_len is a multiple of 4

the trim is skipped entirely), leaving the mask covering more bytes than

the rule matches.

UBSAN: shift-out-of-bounds in net/netfilter/nft_payload.c:278:20

shift exponent 120 is too large for 32-bit type 'int'

...

The match is byte-granular and struct nft_data is zero-initialised, so the

correct mask is simply the first priv_len bytes set to 0xff. Set those

bytes directly and drop the word/shift trimming; this removes the undefined

shift and no longer over-masks the trailing bytes.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References