CVE-2026-52921

A flaw was found in the Linux kernel's netfilter ipset component. Specifically, certain hash set variants (such as hash:ip,mark and hash:ip,port) that iterate IPv4 ranges with a 32-bit iterator do not correctly stop at the end of the requested range. This can cause the iteration to advance beyond the intended boundary, potentially leading to a later retry continuing from an unintended position. This issue could result in incorrect processing of network rules or unexpected system behavior.

This vulnerability is rated as Low impact for Red Hat Enterprise Linux because exploitation requires local administrative privileges (such as the CAP_NET_ADMIN capability) to configure and populate affected hash-based packet filtering sets. Under default enterprise configurations, unprivileged users cannot execute ipset commands or configure range iterations, limiting the attack surface to trusted administrators or container environments where user namespaces grant network management rights. Furthermore, the issue only manifests when specific hash set types process IPv4 address ranges that reach exact boundary conditions, significantly restricting the blast radius to localized filtering misconfigurations or denial-of-service conditions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.