{"id":"CVE-2026-72320","title":"netfilter: nft_lookup: fix catchall element handling with inverted lookups","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_lookup: fix catchall element handling with inverted lookups\n\nnft_lookup_eval() decides whether a lookup matched (`found`) from the\ndirect set lookup and …","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= aaa31047a6d25da0fa101da1ed544e1247949b40 < 0ab8880865f9678eb6174e72c1fc4712e44c745c","Linux >= aaa31047a6d25da0fa101da1ed544e1247949b40 < 238c612357b5a25f03eacf356f95034f8551f218","Linux >= aaa31047a6d25da0fa101da1ed544e1247949b40 < ef0c7d4b04a0e6ad175323c24bc84e11470dd79d","Linux >= aaa31047a6d25da0fa101da1ed544e1247949b40 < e6107a4c74b54cb33e3bce162a63048ae5a6b198","Linux 5.13"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T18:46:52.637095Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T18:55:17.651Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72320","references":[{"url":"https://git.kernel.org/stable/c/0ab8880865f9678eb6174e72c1fc4712e44c745c"},{"url":"https://git.kernel.org/stable/c/238c612357b5a25f03eacf356f95034f8551f218"},{"url":"https://git.kernel.org/stable/c/ef0c7d4b04a0e6ad175323c24bc84e11470dd79d"},{"url":"https://git.kernel.org/stable/c/e6107a4c74b54cb33e3bce162a63048ae5a6b198"}],"tags":["cve.org"],"epss":0.00523,"epssPercentile":0.43085,"ingestedAt":"2026-10-16T19:46:24.408Z","slug":"CVE-2026-72320","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_lookup: fix catchall element handling with inverted lookups\n\nnft_lookup_eval() decides whether a lookup matched (`found`) from the\ndirect set lookup and priv->invert before falling back to the\ncatchall element used by interval sets (e.g. nft_set_rbtree) for the\nopen-ended default range. Since `found` is never recomputed after\n`ext` is replaced by the catchall lookup, inverted lookups\n(NFT_LOOKUP_F_INV, \"!= @set\") can wrongly match or wrongly skip the\ncatchall element, producing the wrong verdict. Fold the catchall\nlookup into `ext` before computing `found`, matching the order\nalready used by nft_objref_map_eval().\n\n## Affected\n\n- `Linux >= aaa31047a6d25da0fa101da1ed544e1247949b40 < 0ab8880865f9678eb6174e72c1fc4712e44c745c`\n- `Linux >= aaa31047a6d25da0fa101da1ed544e1247949b40 < 238c612357b5a25f03eacf356f95034f8551f218`\n- `Linux >= aaa31047a6d25da0fa101da1ed544e1247949b40 < ef0c7d4b04a0e6ad175323c24bc84e11470dd79d`\n- `Linux >= aaa31047a6d25da0fa101da1ed544e1247949b40 < e6107a4c74b54cb33e3bce162a63048ae5a6b198`\n- `Linux 5.13`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}