CVE-2026-72347

HighCVSS 7.3/10Last modified Oct 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_connmark: reject invalid shift parameters

Revision 2 of the CONNMARK target accepts user-controlled shift parameters and applies them to 32-bit mark values in connmark_tg_shift().

A shift_bits value of 32 or more triggers an undefined-shift bug when the rule is evaluated. Invalid shift_dir values are also accepted and silently fall back to the left-shift path.

Reject invalid revision-2 shift parameters in connmark_tg_check() so malformed rules fail at installation time, before they can reach the packet path.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 472a73e00757b971d613d796374d2727b2e4954d, < d8ce63d928b457fba7ed1e302492dfd32293671c; >= 472a73e00757b971d613d796374d2727b2e4954d, < 9657bb11a6376ab0a79f05d433713d6944111e9d; >= 472a73e00757b971d613d796374d2727b2e4954d, < 8ace320ac4416f5e5fbcd065309fb2dfcce787b0; >= 472a73e00757b971d613d796374d2727b2e4954d, < c3fa852d117b3fda72265e4230e3967db4a74fcf; >= 472a73e00757b971d613d796374d2727b2e4954d, < 4eef84b09a3836919360c4232b0f16651a155eec; >= 472a73e00757b971d613d796374d2727b2e4954d, < 230173cc6105bdfb2696d37e6e56687b003fbe63; >= 472a73e00757b971d613d796374d2727b2e4954d, < 1b47026fb4b35bac850ad6e8a4ad7fc018e09ebc
LinuxLinux4.17

References

Timeline

Published
Aug 15, 2026
Last modified
Oct 16, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-723489.1In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdropCVE-2026-72349In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() On links CVE-2026-72355.3A security vulnerability has been detected in ErlichLiu claude-agent-sdk-master up to b185aa7ff0d864581257008077b4010fca1747bf. Affected by CVE-2026-723507.8In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_u32: reject invalid shift counts u32_match_it() executesCVE-2026-723519.8In the Linux kernel, the following vulnerability has been resolved: gue: validate REMCSUM private option length GUE private flags can indiCVE-2026-723527.8In the Linux kernel, the following vulnerability has been resolved: HID: bpf: Fix hid_bpf_get_data() range check hid_bpf_get_data() returnCVE-2026-723538.8In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in fallocate ntfs_attr_fCVE-2026-723548.8In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in MFT writeback ntfs_wrCVE-2026-723559.8In the Linux kernel, the following vulnerability has been resolved: netfs: Fix barriering when walking subrequest list Fix the barriering CVE-2026-723567.5In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs_issue_read() Fix mCVE-2026-723577.8In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline In the unrCVE-2026-723587.8In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: prevent invalid cursor access for purged BOs During a page
CVE-2026-72347: High severity, CVSS 7.3 | Vulnix