CVE-2026-52920

HighCVSS 8.3/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_policy: fix strict mode inbound policy matching

match_policy_in() walks sec_path entries from the last transform to the first one, but strict policy matching needs to consume info->pol[] in the same forward order as the rule layout.

Derive the strict-match policy position from the number of transforms already consumed so that multi-element inbound rules are matched consistently.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Weakness enumeration

CWE-682

Affected software

VendorProductVersions
LinuxLinux>= c4b885139203d37f76662c37ae645fe8e0f4e4e5, < eb323f7b82d2e2f638de0cc2a177803eb20e0707; >= c4b885139203d37f76662c37ae645fe8e0f4e4e5, < fc1c518bb1f054831ecabb32da9b8e1dff9699c6; >= c4b885139203d37f76662c37ae645fe8e0f4e4e5, < f98b7f85e04b40e28b08c461ded0cc79f14f5509; >= c4b885139203d37f76662c37ae645fe8e0f4e4e5, < 82664d0f1ba25e4f9a71994954abae24c60f4067; >= c4b885139203d37f76662c37ae645fe8e0f4e4e5, < b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9; >= c4b885139203d37f76662c37ae645fe8e0f4e4e5, < 938867e870fb5471bb16f442aeac81326e05bf65; >= c4b885139203d37f76662c37ae645fe8e0f4e4e5, < 392cc1d8408b5665215c1e9290bbf0f92339b043; >= c4b885139203d37f76662c37ae645fe8e0f4e4e5, < 4b2b4d7d4e203c92db8966b163edfacb1f0e1e29
LinuxLinux2.6.17

References

Timeline

Published
Jun 24, 2026
Last modified
Oct 19, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-529215.5In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: stop hash:* range iteration at end The following hasCVE-2026-529227.5In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: handle forward allocation error batadv_dat_forward_daCVE-2026-529237.8In the Linux kernel, the following vulnerability has been resolved: ipc: limit next_id allocation to the valid ID range The checkpoint/resCVE-2026-529249.8In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update(CVE-2026-529255.5In the Linux kernel, the following vulnerability has been resolved: vrf: Fix a potential NPD when removing a port from a VRF RCU readers tCVE-2026-529265.5In the Linux kernel, the following vulnerability has been resolved: batman-adv: clear current gateway during teardown batadv_gw_node_free(CVE-2026-529277.8In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix OOB read in compat_mtw_from_user Luxiao Xu saCVE-2026-529285.5In the Linux kernel, the following vulnerability has been resolved: af_unix: Reject SIOCATMARK on non-stream sockets SIOCATMARK reports whCVE-2026-529297.5In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back denied add-stream state When ADD_OUT_STRCVE-2026-52936.4The 診断ジェネレータ作成プラグイン (Diagnosis Generator) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'js' parameter in versioCVE-2026-529305.5In the Linux kernel, the following vulnerability has been resolved: ipc/shm: serialize orphan cleanup with shm_nattch updates shm_destroy_CVE-2026-529319.8In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_a
CVE-2026-52920: High severity, CVSS 8.3 | Vulnix