CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xthashlimit: validate hashtable supports XTHASHLIMITRATEMATCH
The XTHASHLIMITRATEMATCH flag mode changes the semantics of the dsthashent structure which represents an entry in the hashtable. There is a union area which uses a different layout to express the rate match mode.
Update .checkentry path to validate the XTHASHLIMITRATEMATCH mode flag is requested by two or more different rules that refer to the same hashtable. Otherwise, uninitialized access to the burst field in the union is possible.
Reject the use of the XTHASHLIMITRATEMATCH mode flag if set on by revision less than 3 too.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74564?
CVE-2026-74564 has a risk rating of 38.
What software is affected by CVE-2026-74564?
CVE-2026-74564 affects the Linux kernel.
How does CVE-2026-74564 impact the Linux kernel?
CVE-2026-74564 changes the semantics of the dsthash_ent structure within the netfilter xt_hashlimit component.
What does the XT_HASHLIMIT_RATE_MATCH flag do in CVE-2026-74564?
The XT_HASHLIMIT_RATE_MATCH flag modifies how the hashtable validates entries for rate matching.
How can I mitigate CVE-2026-74564?
To mitigate CVE-2026-74564, update to the latest version of the Linux kernel where this vulnerability is resolved.