CVE-2026-72350: netfilter: xt_u32: reject invalid shift counts

CVE-2026-72350: netfilter: xt_u32: reject invalid shift counts

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_u32: reject invalid shift counts

u32_match_it() executes rule-supplied shift operands on a 32-bit
value. A malformed u32 rule can provide a shift count of 32 or more,
triggering an undefined shift out-of-bounds during packet evaluation.

Validate XT_U32_LEFTSH and XT_U32_RIGHTSH operands in
u32_mt_checkentry() and reject malformed rules before they reach the
packet path.

The Linux kernel CVE team has assigned CVE-2026-72350 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.23 with commit 1b50b8a371e90a5e110f466e4ac02cf6b5f681de and fixed in 5.10.261 with commit ca7c92d9701249e6daf132087756a88cbf2bb2a3
	Issue introduced in 2.6.23 with commit 1b50b8a371e90a5e110f466e4ac02cf6b5f681de and fixed in 5.15.212 with commit b33b44250d57ab0e5a1e2571b5285fb0d0a7f382
	Issue introduced in 2.6.23 with commit 1b50b8a371e90a5e110f466e4ac02cf6b5f681de and fixed in 6.1.178 with commit 728f479dc0447ae7eaef87926ff49142e415a811
	Issue introduced in 2.6.23 with commit 1b50b8a371e90a5e110f466e4ac02cf6b5f681de and fixed in 6.6.145 with commit 0a8b7a6d763775709c601f584e709ae48bcc000a
	Issue introduced in 2.6.23 with commit 1b50b8a371e90a5e110f466e4ac02cf6b5f681de and fixed in 6.12.97 with commit cce42014415cecd98aa49b3950e7b02ee7c81268
	Issue introduced in 2.6.23 with commit 1b50b8a371e90a5e110f466e4ac02cf6b5f681de and fixed in 6.18.40 with commit a597a722fb71a534138c20359b655726622b5f17
	Issue introduced in 2.6.23 with commit 1b50b8a371e90a5e110f466e4ac02cf6b5f681de and fixed in 7.1.5 with commit 00d034fe8230dfc5832fe011ff2d81c1a2cc7a29
	Issue introduced in 2.6.23 with commit 1b50b8a371e90a5e110f466e4ac02cf6b5f681de and fixed in 7.2-rc3 with commit 64cdf7d30ac18e43df6c48004435febb965809a8

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72350
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/netfilter/xt_u32.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ca7c92d9701249e6daf132087756a88cbf2bb2a3
	https://git.kernel.org/stable/c/b33b44250d57ab0e5a1e2571b5285fb0d0a7f382
	https://git.kernel.org/stable/c/728f479dc0447ae7eaef87926ff49142e415a811
	https://git.kernel.org/stable/c/0a8b7a6d763775709c601f584e709ae48bcc000a
	https://git.kernel.org/stable/c/cce42014415cecd98aa49b3950e7b02ee7c81268
	https://git.kernel.org/stable/c/a597a722fb71a534138c20359b655726622b5f17
	https://git.kernel.org/stable/c/00d034fe8230dfc5832fe011ff2d81c1a2cc7a29
	https://git.kernel.org/stable/c/64cdf7d30ac18e43df6c48004435febb965809a8