CVE-2026-72320

A flaw was found in the Linux kernel's netfilter component, specifically within the nft_lookup functionality. This issue arises from incorrect handling of 'catchall' elements during 'inverted lookups' in the nft_lookup_eval() function. Due to a logic error where the lookup result is not recomputed, network packets may be wrongly matched or skipped, leading to incorrect application of network filtering rules. This could potentially allow unauthorized network traffic or cause denial of service by incorrectly dropping legitimate traffic.

An nftables logic error in nft_lookup_eval can evaluate inverted set lookups incorrectly when a direct lookup misses and an interval set catchall element should be used. A remote packet can trigger the wrong verdict if the target system already has a ruleset using NFT_LOOKUP_F_INV with a catchall interval set, which may allow traffic that should be blocked or block traffic that should be allowed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.