---
id: CVE-2026-52920
title: 'netfilter: xt_policy: fix strict mode inbound policy matching'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: xt_policy: fix strict mode inbound policy matching

  match_policy_in() walks sec_path entries from the last transform to the
  first one, but strict policy matc…
severity: high
cvss: 8.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c4b885139203d37f76662c37ae645fe8e0f4e4e5 <
    eb323f7b82d2e2f638de0cc2a177803eb20e0707
  - >-
    Linux >= c4b885139203d37f76662c37ae645fe8e0f4e4e5 <
    fc1c518bb1f054831ecabb32da9b8e1dff9699c6
  - >-
    Linux >= c4b885139203d37f76662c37ae645fe8e0f4e4e5 <
    f98b7f85e04b40e28b08c461ded0cc79f14f5509
  - >-
    Linux >= c4b885139203d37f76662c37ae645fe8e0f4e4e5 <
    82664d0f1ba25e4f9a71994954abae24c60f4067
  - >-
    Linux >= c4b885139203d37f76662c37ae645fe8e0f4e4e5 <
    b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9
  - >-
    Linux >= c4b885139203d37f76662c37ae645fe8e0f4e4e5 <
    938867e870fb5471bb16f442aeac81326e05bf65
  - >-
    Linux >= c4b885139203d37f76662c37ae645fe8e0f4e4e5 <
    392cc1d8408b5665215c1e9290bbf0f92339b043
  - >-
    Linux >= c4b885139203d37f76662c37ae645fe8e0f4e4e5 <
    4b2b4d7d4e203c92db8966b163edfacb1f0e1e29
  - Linux 2.6.17
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T15:22:43.940602Z'
published: '2026-06-24'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:31:19.057Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-52920'
references:
  - url: 'https://git.kernel.org/stable/c/eb323f7b82d2e2f638de0cc2a177803eb20e0707'
  - url: 'https://git.kernel.org/stable/c/fc1c518bb1f054831ecabb32da9b8e1dff9699c6'
  - url: 'https://git.kernel.org/stable/c/f98b7f85e04b40e28b08c461ded0cc79f14f5509'
  - url: 'https://git.kernel.org/stable/c/82664d0f1ba25e4f9a71994954abae24c60f4067'
  - url: 'https://git.kernel.org/stable/c/b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9'
  - url: 'https://git.kernel.org/stable/c/938867e870fb5471bb16f442aeac81326e05bf65'
  - url: 'https://git.kernel.org/stable/c/392cc1d8408b5665215c1e9290bbf0f92339b043'
  - url: 'https://git.kernel.org/stable/c/4b2b4d7d4e203c92db8966b163edfacb1f0e1e29'
tags:
  - cve.org
epss: 0.00299
epssPercentile: 0.21134
ingestedAt: '2026-10-16T17:24:46.719Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_policy: fix strict mode inbound policy matching

match_policy_in() walks sec_path entries from the last transform to the
first one, but strict policy matching needs to consume info->pol[] in
the same forward order as the rule layout.

Derive the strict-match policy position from the number of transforms
already consumed so that multi-element inbound rules are matched
consistently.

## Affected

- `Linux >= c4b885139203d37f76662c37ae645fe8e0f4e4e5 < eb323f7b82d2e2f638de0cc2a177803eb20e0707`
- `Linux >= c4b885139203d37f76662c37ae645fe8e0f4e4e5 < fc1c518bb1f054831ecabb32da9b8e1dff9699c6`
- `Linux >= c4b885139203d37f76662c37ae645fe8e0f4e4e5 < f98b7f85e04b40e28b08c461ded0cc79f14f5509`
- `Linux >= c4b885139203d37f76662c37ae645fe8e0f4e4e5 < 82664d0f1ba25e4f9a71994954abae24c60f4067`
- `Linux >= c4b885139203d37f76662c37ae645fe8e0f4e4e5 < b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9`
- `Linux >= c4b885139203d37f76662c37ae645fe8e0f4e4e5 < 938867e870fb5471bb16f442aeac81326e05bf65`
- `Linux >= c4b885139203d37f76662c37ae645fe8e0f4e4e5 < 392cc1d8408b5665215c1e9290bbf0f92339b043`
- `Linux >= c4b885139203d37f76662c37ae645fe8e0f4e4e5 < 4b2b4d7d4e203c92db8966b163edfacb1f0e1e29`
- `Linux 2.6.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.