CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xtpolicy: fix strict mode inbound policy matching
matchpolicyin() walks secpath entries from the last transform to the first one, but strict policy matching needs to consume info->pol[] in the same forward order as the rule layout.
Derive the strict-match policy position from the number of transforms already consumed so that multi-element inbound rules are matched consistently.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xtpolicy: fix strict mode inbound policy matching
matchpolicyin() walks secpath entries from the last transform to the first one, but strict policy matching needs to consume info-pol[] in the same forward order as the rule layout.
Derive the strict-match policy position from the number of transforms already consumed so that multi-element inbound rules are matched consistently.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52920?
CVE-2026-52920 has a risk score of 18, indicating a high level of severity.
How do I fix CVE-2026-52920?
To fix CVE-2026-52920, ensure that you update your Linux kernel to the latest patched version.
What systems are affected by CVE-2026-52920?
CVE-2026-52920 affects systems running vulnerable versions of the Linux kernel that utilize the netfilter xt_policy module.
What kind of vulnerability is CVE-2026-52920?
CVE-2026-52920 is a vulnerability in the Linux kernel related to incorrect strict mode inbound policy matching in the netfilter subsystem.
What are the implications of CVE-2026-52920?
The implications of CVE-2026-52920 include potential bypass of security policies, which may lead to unauthorized network access.