netfilter: nft_lookup: fix catchall element handling with inverted lookups
CVE-2026-72320 · published 15 Aug 2026
How serious is it
- Severity: critical, CVSS score 9.1 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-72320?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: aaa31047a6d25da0fa101da1ed544e1247949b40 to < 65d35cb555f40529a9edc6bf4beaa3bee917f015, aaa31047a6d25da0fa101da1ed544e1247949b40 to < 0ab8880865f9678eb6174e72c1fc4712e44c745c, aaa31047a6d25da0fa101da1ed544e1247949b40 to < 238c612357b5a25f03eacf356f95034f8551f218, aaa31047a6d25da0fa101da1ed544e1247949b40 to < ef0c7d4b04a0e6ad175323c24bc84e11470dd79d
- Linux Linux: 5.13
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_lookup: fix catchall element handling with inverted lookups
nft_lookup_eval() decides whether a lookup matched (`found`) from the
direct set lookup and priv->invert before falling back to the
catchall element used by interval sets (e.g. nft_set_rbtree) for the
open-ended default range. Since `found` is never recomputed after
`ext` is replaced by the catchall lookup, inverted lookups
(NFT_LOOKUP_F_INV, "!= @set") can wrongly match or wrongly skip the
catchall element, producing the wrong verdict. Fold the catchall
lookup into `ext` before computing `found`, matching the order
already used by nft_objref_map_eval().
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/65d35cb555f40529a9edc6bf4beaa3bee917f015
- git.kernel.org/stable/c/0ab8880865f9678eb6174e72c1fc4712e44c745c
- git.kernel.org/stable/c/238c612357b5a25f03eacf356f95034f8551f218
- git.kernel.org/stable/c/ef0c7d4b04a0e6ad175323c24bc84e11470dd79d
- git.kernel.org/stable/c/e6107a4c74b54cb33e3bce162a63048ae5a6b198
Merged from CVE List. Last updated 25 Oct 2026. All vulnerabilities · RSS · JSON