From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 427BB373C00 for ; Sat, 15 Aug 2026 06:23:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786775021; cv=none; b=XxiMJv7XoUyBeTaVPqUfe1qWWh7KDFpCIiM3T84FRm9xMiJtEs0nOqETB/7xKimG5Cxw1Wg4VtlWmYjSg2IjnjatctKke8Lz9PtwNT0/wdr8GMCOQ9ShGW9l7ZtivwbiVf9rMi6VKsiVGBgOgqIk6u/MZfqSclT7Rzw/5Z6okBI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786775021; c=relaxed/simple; bh=mUIw8lcacETcZNkM2kGTBXiUAqXHNaMrJFlFwZZGBD8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=roJG/gQ48dSTdRx4JqaiGydhhZd+j6GytcqUx2j4U7IkmTMR4iyXZ8JXavjZ0qi075w7TlZ+NGjUdf46Gy/unbA/eSWmEg1N+8CrKdy+cJf3gjng47TdRMiTU3yVs6avOfVohsi7H59sVk4Z+IKpPJqw59Y58oH+qmvRnJUjZ5Y= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Okp4K9j4; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Okp4K9j4" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 98F5B1F000E9; Sat, 15 Aug 2026 06:23:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786775019; bh=bikRSw0A33XohcMrd/TsKOh3Z0rCZKW+Y4WC17CEIRs=; h=From:To:Cc:Subject:Date:Reply-To; b=Okp4K9j4ck/kMKa8eV5Au+t6MzJ/qY6tP1LpfZJ5pnUSztEJF8vSwvbRvYweMR1yD z5faMlGAgPMUT/nSi6kyAvRLFQcNemgX1B8kklZ5SnZFG4NGe9FD+HvaIOROoKXD9Z gXDqWQ1WHeDCJmIimXg2p9GJ5uE++6tXtXN31IEg= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-72347: netfilter: xt_connmark: reject invalid shift parameters Date: Sat, 15 Aug 2026 15:07:06 +0900 Message-ID: <2026081511-CVE-2026-72347-6871@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3397; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=VPvd4rjKEYYNxXewkN0pWUKBrS74kw8hlu0wI/OlIRk=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkNDI/5v/82SZBkNPtRc/wep4Kvcv4vr1RlOR6Xv2eWb 33NtPd8RywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEwk2JNhfuI7xZfeVno9ce3r mde1abcHmiTMZJgr7fZxP+PGu/ONquOOfDjnID6z92wKAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_connmark: reject invalid shift parameters Revision 2 of the CONNMARK target accepts user-controlled shift parameters and applies them to 32-bit mark values in connmark_tg_shift(). A shift_bits value of 32 or more triggers an undefined-shift bug when the rule is evaluated. Invalid shift_dir values are also accepted and silently fall back to the left-shift path. Reject invalid revision-2 shift parameters in connmark_tg_check() so malformed rules fail at installation time, before they can reach the packet path. The Linux kernel CVE team has assigned CVE-2026-72347 to this issue. Affected and fixed versions =========================== Issue introduced in 4.17 with commit 472a73e00757b971d613d796374d2727b2e4954d and fixed in 5.15.212 with commit d8ce63d928b457fba7ed1e302492dfd32293671c Issue introduced in 4.17 with commit 472a73e00757b971d613d796374d2727b2e4954d and fixed in 6.1.178 with commit 9657bb11a6376ab0a79f05d433713d6944111e9d Issue introduced in 4.17 with commit 472a73e00757b971d613d796374d2727b2e4954d and fixed in 6.6.145 with commit 8ace320ac4416f5e5fbcd065309fb2dfcce787b0 Issue introduced in 4.17 with commit 472a73e00757b971d613d796374d2727b2e4954d and fixed in 6.12.97 with commit c3fa852d117b3fda72265e4230e3967db4a74fcf Issue introduced in 4.17 with commit 472a73e00757b971d613d796374d2727b2e4954d and fixed in 6.18.40 with commit 4eef84b09a3836919360c4232b0f16651a155eec Issue introduced in 4.17 with commit 472a73e00757b971d613d796374d2727b2e4954d and fixed in 7.1.5 with commit 230173cc6105bdfb2696d37e6e56687b003fbe63 Issue introduced in 4.17 with commit 472a73e00757b971d613d796374d2727b2e4954d and fixed in 7.2-rc3 with commit 1b47026fb4b35bac850ad6e8a4ad7fc018e09ebc Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-72347 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/netfilter/xt_connmark.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/d8ce63d928b457fba7ed1e302492dfd32293671c https://git.kernel.org/stable/c/9657bb11a6376ab0a79f05d433713d6944111e9d https://git.kernel.org/stable/c/8ace320ac4416f5e5fbcd065309fb2dfcce787b0 https://git.kernel.org/stable/c/c3fa852d117b3fda72265e4230e3967db4a74fcf https://git.kernel.org/stable/c/4eef84b09a3836919360c4232b0f16651a155eec https://git.kernel.org/stable/c/230173cc6105bdfb2696d37e6e56687b003fbe63 https://git.kernel.org/stable/c/1b47026fb4b35bac850ad6e8a4ad7fc018e09ebc