CVE-2026-74579

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the nft payload offload mask() function within the netfilter module. When building an offload match mask for a payload expression covering only part of a header field, such as a partial IPv6 address match, the system performs a shift operation that can be undefined on 32-bit integer operands. Specifically, a shift exponent of 120 may be used, which exceeds the capacity of a 32-bit int. Additionally, the process may fail to trim words correctly, resulting in a mask that covers more bytes than the rule actually matches.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.