---
id: CVE-2026-74564
title: 'netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH

  The XT_HASHLIMIT_RATE_MATCH flag mode changes the semantics of the
  dsthash_ent structure w…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= bea74641e3786d51dcf1175527cc1781420961c9 <
    402befce5854c195058cf4bab7c78ca286068a26
  - >-
    Linux >= bea74641e3786d51dcf1175527cc1781420961c9 <
    dee686b5e7f21180538ff719867702f411c8eb5c
  - >-
    Linux >= bea74641e3786d51dcf1175527cc1781420961c9 <
    f76ab783e7d8d33e33dd7dfa697297f70d57b0e8
  - >-
    Linux >= bea74641e3786d51dcf1175527cc1781420961c9 <
    24683fea1f06bd3bd2707b99460e859bc6464c22
  - >-
    Linux >= bea74641e3786d51dcf1175527cc1781420961c9 <
    32ec8d4aba2cf22e12bdc28df8c4bd833c195fc0
  - >-
    Linux >= bea74641e3786d51dcf1175527cc1781420961c9 <
    d186f77d18bdfb252d401ff992ca3001a6a65a0f
  - >-
    Linux >= bea74641e3786d51dcf1175527cc1781420961c9 <
    06a76334243ccd875a981aa8bb46c0f931ef1e3b
  - >-
    Linux >= bea74641e3786d51dcf1175527cc1781420961c9 <
    305b63e1402267459fdabb183af4527f6799eebf
  - Linux 4.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T19:00:14.735165Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:56.067Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74564'
references:
  - url: 'https://git.kernel.org/stable/c/402befce5854c195058cf4bab7c78ca286068a26'
  - url: 'https://git.kernel.org/stable/c/dee686b5e7f21180538ff719867702f411c8eb5c'
  - url: 'https://git.kernel.org/stable/c/f76ab783e7d8d33e33dd7dfa697297f70d57b0e8'
  - url: 'https://git.kernel.org/stable/c/24683fea1f06bd3bd2707b99460e859bc6464c22'
  - url: 'https://git.kernel.org/stable/c/32ec8d4aba2cf22e12bdc28df8c4bd833c195fc0'
  - url: 'https://git.kernel.org/stable/c/d186f77d18bdfb252d401ff992ca3001a6a65a0f'
  - url: 'https://git.kernel.org/stable/c/06a76334243ccd875a981aa8bb46c0f931ef1e3b'
  - url: 'https://git.kernel.org/stable/c/305b63e1402267459fdabb183af4527f6799eebf'
tags:
  - cve.org
epss: 0.00118
epssPercentile: 0.01594
ingestedAt: '2026-10-16T19:46:24.344Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH

The XT_HASHLIMIT_RATE_MATCH flag mode changes the semantics of the
dsthash_ent structure which represents an entry in the hashtable.  There
is a union area which uses a different layout to express the rate match
mode.

Update .checkentry path to validate the XT_HASHLIMIT_RATE_MATCH mode
flag is requested by two or more different rules that refer to the same
hashtable. Otherwise, uninitialized access to the burst field in the
union is possible.

Reject the use of the XT_HASHLIMIT_RATE_MATCH mode flag if set on by
revision less than 3 too.

## Affected

- `Linux >= bea74641e3786d51dcf1175527cc1781420961c9 < 402befce5854c195058cf4bab7c78ca286068a26`
- `Linux >= bea74641e3786d51dcf1175527cc1781420961c9 < dee686b5e7f21180538ff719867702f411c8eb5c`
- `Linux >= bea74641e3786d51dcf1175527cc1781420961c9 < f76ab783e7d8d33e33dd7dfa697297f70d57b0e8`
- `Linux >= bea74641e3786d51dcf1175527cc1781420961c9 < 24683fea1f06bd3bd2707b99460e859bc6464c22`
- `Linux >= bea74641e3786d51dcf1175527cc1781420961c9 < 32ec8d4aba2cf22e12bdc28df8c4bd833c195fc0`
- `Linux >= bea74641e3786d51dcf1175527cc1781420961c9 < d186f77d18bdfb252d401ff992ca3001a6a65a0f`
- `Linux >= bea74641e3786d51dcf1175527cc1781420961c9 < 06a76334243ccd875a981aa8bb46c0f931ef1e3b`
- `Linux >= bea74641e3786d51dcf1175527cc1781420961c9 < 305b63e1402267459fdabb183af4527f6799eebf`
- `Linux 4.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.