Re: [SECURITY] nft_byteorder: incorrect u32* stride in 64-bit byteorder eval leading to firewall bypass

[Greg KH <gregkh@linuxfoundation.org>]

On Tue, May 19, 2026 at 07:42:15PM +0200, Igor Garofano wrote:
> SUMMARY
> =======
> 
> A logic error in nft_byteorder_eval() causes incorrect byteorder conversion
> for 64-bit (size=8) operations in nftables. The source register is indexed
> using a u32* pointer (4-byte stride) while nft_reg_load64() reads 8 bytes,
> causing overlapping reads for any priv->len > 8. The result is that bytes
> are swapped from the wrong positions, leading to incorrect packet matching
> decisions.
> 
> This can be exploited by a remote attacker to bypass nftables firewall rules
> that use 64-bit byteorder expressions, without requiring any privilege on
> the
> target system.
> 
> 
> AFFECTED VERSIONS
> =================
> 
> Confirmed affected: Linux 6.19.13 (net/netfilter/nft_byteorder.c)

6.19.y is end-of-life, have you tried the latest 7.1-rc4 release?

> PROPOSED FIX
> ============
> 
> Cast source pointer to u64* before the size=8 loop to obtain correct
> 8-byte stride, matching the destination pointer type:
> 
> --- a/net/netfilter/nft_byteorder.c
> +++ b/net/netfilter/nft_byteorder.c
> @@ -39,19 +39,21 @@ void nft_byteorder_eval(const struct nft_expr *expr,
>         switch (priv->size) {
>         case 8: {
>                 u64 *dst64 = (void *)dst;
> +               u64 *src64 = (void *)src;
>                 u64 src_val;
> 
>                 switch (priv->op) {
>                 case NFT_BYTEORDER_NTOH:
>                         for (i = 0; i < priv->len / 8; i++) {
> -                               src64 = nft_reg_load64(&src[i]);
> +                               src_val = nft_reg_load64((u32 *)&src
>                                 nft_reg_store64(&dst64[i],
> -                                               be64_to_cpu((__force
> +                                               be64_to_cpu((__force
> __be64)src_val));
>                         }
>                         break;
>                 case NFT_BYTEORDER_HTON:
>                         for (i = 0; i < priv->len / 8; i++) {
> -                               src64 = (__force __u64)
> -
> cpu_to_be64(nft_reg_load64(&src[i]));
> +                               src_val = (__force __u64)
> +                                       cpu_to_be64(nft_reg_load64((u32
> *)&src64[i]));
>                                 nft_reg_store64(&dst64[i], src64);
>                         }
> +                               nft_reg_store64(&dst64[i], src_val);
>                         break;
>                 }
>                 break;
> 

Can you turn this into a real patch that can be applied so you get full
credit for resolving this issue?

thanks,

greg k-h