CVE-2026-72320

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the netfilter component where the nft lookup eval() function incorrectly handles catchall elements during inverted lookups (NFT LOOKUP F INV). The function determines if a lookup matched based on the found variable and priv->invert before considering the catchall element used by interval sets, such as nft set rbtree. Because found is not recomputed after the ext variable is replaced by the catchall lookup, inverted lookups may wrongly match or skip the catchall element, leading to an incorrect verdict.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.