CVE-2026-64006

A flaw was found in the Linux kernel's Netfilter nf_tables component. This vulnerability occurs during lshift and rshift operations when the source and destination registers point to the same memory location. An incorrect calculation of the carry value, using the modified destination instead of the original source, leads to data corruption. This could potentially allow a local attacker to cause system instability or other undefined behavior.

nf_tables bitwise shift evaluation can compute an incorrect carry when source and destination registers refer to the same storage, because the code may read a value after it has already been overwritten. Partial register overlap in bitwise or byteorder expressions can also produce incorrect expression results. This is a control plane rule semantics issue rather than kernel memory corruption. For the CVSS the PR:L is used for the paranoid score because a low privileged actor may be able to manage nftables inside a network namespace, container, or delegated firewall management context. The issue is not directly network reachable because packet traffic does not create the malformed rule by itself. Impact is primarily integrity loss of packet filtering decisions, such as unexpected match results or policy bypass in a crafted ruleset.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.