---
id: CVE-2026-72320
title: 'netfilter: nft_lookup: fix catchall element handling with inverted lookups'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nft_lookup: fix catchall element handling with inverted lookups

  nft_lookup_eval() decides whether a lookup matched (`found`) from the
  direct set lookup and …
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= aaa31047a6d25da0fa101da1ed544e1247949b40 <
    0ab8880865f9678eb6174e72c1fc4712e44c745c
  - >-
    Linux >= aaa31047a6d25da0fa101da1ed544e1247949b40 <
    238c612357b5a25f03eacf356f95034f8551f218
  - >-
    Linux >= aaa31047a6d25da0fa101da1ed544e1247949b40 <
    ef0c7d4b04a0e6ad175323c24bc84e11470dd79d
  - >-
    Linux >= aaa31047a6d25da0fa101da1ed544e1247949b40 <
    e6107a4c74b54cb33e3bce162a63048ae5a6b198
  - Linux 5.13
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T18:46:52.637095Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:55:17.651Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72320'
references:
  - url: 'https://git.kernel.org/stable/c/0ab8880865f9678eb6174e72c1fc4712e44c745c'
  - url: 'https://git.kernel.org/stable/c/238c612357b5a25f03eacf356f95034f8551f218'
  - url: 'https://git.kernel.org/stable/c/ef0c7d4b04a0e6ad175323c24bc84e11470dd79d'
  - url: 'https://git.kernel.org/stable/c/e6107a4c74b54cb33e3bce162a63048ae5a6b198'
tags:
  - cve.org
epss: 0.00523
epssPercentile: 0.43085
ingestedAt: '2026-10-16T19:46:24.408Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_lookup: fix catchall element handling with inverted lookups

nft_lookup_eval() decides whether a lookup matched (`found`) from the
direct set lookup and priv->invert before falling back to the
catchall element used by interval sets (e.g. nft_set_rbtree) for the
open-ended default range. Since `found` is never recomputed after
`ext` is replaced by the catchall lookup, inverted lookups
(NFT_LOOKUP_F_INV, "!= @set") can wrongly match or wrongly skip the
catchall element, producing the wrong verdict. Fold the catchall
lookup into `ext` before computing `found`, matching the order
already used by nft_objref_map_eval().

## Affected

- `Linux >= aaa31047a6d25da0fa101da1ed544e1247949b40 < 0ab8880865f9678eb6174e72c1fc4712e44c745c`
- `Linux >= aaa31047a6d25da0fa101da1ed544e1247949b40 < 238c612357b5a25f03eacf356f95034f8551f218`
- `Linux >= aaa31047a6d25da0fa101da1ed544e1247949b40 < ef0c7d4b04a0e6ad175323c24bc84e11470dd79d`
- `Linux >= aaa31047a6d25da0fa101da1ed544e1247949b40 < e6107a4c74b54cb33e3bce162a63048ae5a6b198`
- `Linux 5.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.