Linux Kernel: XT_HASHLIMIT_RATE_MATCH Uninitialized Access Vulnerability (CVE-2026-74564)
CVE-2026-74564 Published on August 15, 2026
netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
The XT_HASHLIMIT_RATE_MATCH flag mode changes the semantics of the
dsthash_ent structure which represents an entry in the hashtable. There
is a union area which uses a different layout to express the rate match
mode.
Update .checkentry path to validate the XT_HASHLIMIT_RATE_MATCH mode
flag is requested by two or more different rules that refer to the same
hashtable. Otherwise, uninitialized access to the burst field in the
union is possible.
Reject the use of the XT_HASHLIMIT_RATE_MATCH mode flag if set on by
revision less than 3 too.
Products Associated with CVE-2026-74564
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version bea74641e3786d51dcf1175527cc1781420961c9 and below 24683fea1f06bd3bd2707b99460e859bc6464c22 is affected.
- Version bea74641e3786d51dcf1175527cc1781420961c9 and below 32ec8d4aba2cf22e12bdc28df8c4bd833c195fc0 is affected.
- Version bea74641e3786d51dcf1175527cc1781420961c9 and below d186f77d18bdfb252d401ff992ca3001a6a65a0f is affected.
- Version bea74641e3786d51dcf1175527cc1781420961c9 and below 06a76334243ccd875a981aa8bb46c0f931ef1e3b is affected.
- Version bea74641e3786d51dcf1175527cc1781420961c9 and below 305b63e1402267459fdabb183af4527f6799eebf is affected.
- Version 4.14 is affected.
- Before 4.14 is unaffected.
- Version 6.6.151, <= 6.6.* is unaffected.
- Version 6.12.103, <= 6.12.* is unaffected.
- Version 6.18.44, <= 6.18.* is unaffected.
- Version 7.1.8, <= 7.1.* is unaffected.
- Version 7.2-rc6, <= * is unaffected.