CVE-2026-72436: netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: Don't use testbit() in lockless RCU readers in hash types
Sashiko pointed out that there are a few lockless RCU readers using testbit() which is a relaxed atomic operation and provides no memory barrier guarantees. Use testbitacquire() instead where the operation may run parallel with add/del/gc, i.e. is not one from the next cases
- protected by region lock - in a set destroy phase - in a new/temporary set creation phase
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72436?
CVE-2026-72436 has a risk level of 34, indicating a moderate severity potential.
How do I fix CVE-2026-72436?
To fix CVE-2026-72436, update your Linux kernel to the latest stable version where the vulnerability has been patched.
What are the impacts of CVE-2026-72436 on the Linux Kernel?
CVE-2026-72436 can lead to improper memory handling due to relaxed atomic operations in lockless RCU readers.
Which versions of the Linux Kernel are affected by CVE-2026-72436?
CVE-2026-72436 affects specific versions of the Linux Kernel that use the ipset implementation with hash types.
Is CVE-2026-72436 publicly disclosed?
Yes, CVE-2026-72436 was publicly disclosed on August 15, 2026.