CVE-2026-72347: netfilter: xt_connmark: reject invalid shift parameters
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xtconnmark: reject invalid shift parameters
Revision 2 of the CONNMARK target accepts user-controlled shift parameters and applies them to 32-bit mark values in connmarktgshift().
A shiftbits value of 32 or more triggers an undefined-shift bug when the rule is evaluated. Invalid shiftdir values are also accepted and silently fall back to the left-shift path.
Reject invalid revision-2 shift parameters in connmarktgcheck() so malformed rules fail at installation time, before they can reach the packet path.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72347?
CVE-2026-72347 has a risk rating of 37, indicating a moderate level of severity.
How do I fix CVE-2026-72347?
To mitigate CVE-2026-72347, update your Linux kernel to the latest version where this vulnerability has been patched.
What is the impact of CVE-2026-72347?
CVE-2026-72347 allows user-controlled shift parameters that may lead to undefined behavior in the Linux kernel.
Which software is affected by CVE-2026-72347?
The vulnerability CVE-2026-72347 affects the Linux Kernel as managed by the Linux Kernel Community.
When was CVE-2026-72347 published?
CVE-2026-72347 was published on August 15, 2026.