{"id":9129,"date":"2026-09-04T18:50:15","date_gmt":"2026-09-04T10:50:15","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74579-2"},"modified":"2026-09-04T18:50:15","modified_gmt":"2026-09-04T10:50:15","slug":"cve-2026-74579-2","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74579-2","title":{"rendered":"CVE-2026-74579 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_payloa"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>netfilter: nft_payload: fix mask build for partial field offload<\/p>\n<p>nft_payload_offload_mask() builds the offload match mask for a payload<br \/>\nexpression that covers only part of a header field.  For a partial IPv6<br \/>\naddress match (field_len = 16, priv_len = 1) that shift is 1 &lt;&lt; 120, which<br \/>\nis undefined on the 32-bit int operand.  It also trims only one word, so<br \/>\nthe remaining words stay 0xffffffff (and when priv_len is a multiple of 4<br \/>\nthe trim is skipped entirely), leaving the mask covering more bytes than<br \/>\nthe rule matches.<\/p>\n<p>  UBSAN: shift-out-of-bounds in net\/netfilter\/nft_payload.c:278:20<br \/>\n  shift exponent 120 is too large for 32-bit type &#039;int&#039;<br \/>\n  &#8230;<\/p>\n<p>The match is byte-granular and struct nft_data is zero-initialised, so the<br \/>\ncorrect mask is simply the first priv_len bytes set to 0xff. Set those<br \/>\nbytes directly and drop the word\/shift trimming; this removes the undefined<br \/>\nshift and no longer over-masks the trailing bytes.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>netfilter: nft_payload: fix mask build for partial field offload<\/p>\n<p>nft_payload_offload_mask() builds the offload match mask for a pa<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-9129","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/9129","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9129"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9129"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9129"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}