Look up another CVE · open CVE-2026-72347 in the interactive tracker
CVE-2026-72347
netfilter: xt_connmark: reject invalid shift parameters
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem net/netfilter. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-72347 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.180-1 | Update the kernel and reboot. Fixed in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Revision 2 of the CONNMARK target accepts user-controlled shift parameters and applies them to 32-bit mark values in connmark_tg_shift(). A shift_bits value of 32 or more triggers an undefined-shift bug when the rule is evaluated. Invalid shift_dir values are also accepted and silently fall back to the left-shift path. Reject invalid revision-2 shift parameters in connmark_tg_check() so malformed rules fail at installation time, before they can reach the packet path.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/netfilter/xt_connmark.c
- What this is
- NETFILTERMAINTAINERS section matched on net/netfilter/ · netfilter-devel@vger.kernel.org · Maintained
- Kernel module
- xt_connmark
Check it on the machine
grep -wE 'CONFIG_NETFILTER|CONFIG_NETFILTER_XT_CONNMARK' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w xt_connmarkPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sidm
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_NETFILTER, CONFIG_NETFILTER_XT_CONNMARK
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 7.3 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 6.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/netfilter
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.17 | 5.15.212 | d8ce63d928b4 |
| 4.17 | 6.1.178 | 9657bb11a637 |
| 4.17 | 6.6.145 | 8ace320ac441 |
| 4.17 | 6.12.97 | c3fa852d117b |
| 4.17 | 6.18.40 | 4eef84b09a38 |
| 4.17 | 7.1.5 | 230173cc6105 |
| 4.17 | 7.2 | 1b47026fb4b3 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- Malformed CONNMARK rev2 rules are installed via IPT_SO_SET_REPLACE setsockopt or nftables NFNetlink (nft_compat); per kernel CNA guidance netfilter/xtables rule setup is Local even though installed rules later evaluate on ingress/egress packets through ipt_do_table/ip6t_do_table.
- AC:LAttack complexity, low
- The attacker fully controls shift_bits and shift_dir in xt_connmark_tginfo2 when installing the rev2 CONNMARK target and can send conntrack-tracked packets to reliably hit connmark_tg_shift(); no race, memory layout, or victim state outside attacker control is required.
- PR:LPrivileges required, low
- Installing CONNMARK iptables/nftables rules requires CAP_NET_ADMIN in the target network namespace, obtainable by unprivileged users via unshare -Urn; ip_tables.c do_ipt_set_ctl() and nfnetlink.c nfnetlink_rcv() enforce ns_capable/netlink_net_capable against the namespace user_ns.
- UI:NUser interaction, none
- The attacker installs the malformed CONNMARK rev2 rule and generates matching conntrack-associated traffic in their namespace; no separate victim action such as opening files, mounting media, or clicking links is required.
- S:UScope, unchanged
- Undefined shift during xt_CONNMARK packet targeting and resulting mark corruption remain within the host kernel security authority; this is standard local kernel netfilter compromise, not a VM escape, IOMMU bypass, or sandbox boundary crossing.
- C:LConfidentiality impact, low
- Undefined-behavior shifts on 32-bit mark values produce attacker-influenced unpredictable ct->mark and skb->mark results observable through conntrack netlink and mark-based iptables/nftables matches, leaking altered connection-classification state within the namespace.
- I:HIntegrity impact, high
- Invalid shift_bits or shift_dir corrupt connmark_tg_shift() output written to nf_conn->mark and skb->mark, subverting mark-dependent firewall, policy-routing, QoS, and multi-tenant container egress controls on cloud routers and internet-facing servers.
- A:HAvailability impact, high
- Evaluating a malformed CONNMARK rev2 rule with shift_bits>=32 triggers C11 undefined-shift UB in connmark_tg_shift() during softirq netfilter processing; UBSAN-instrumented kernels panic on shift-out-of-bounds, and UB in the packet hot path can destabilize conntrack-driven forwarding.