CVE-2026-72349

A flaw was found in the Linux kernel's netfilter component, specifically within the xt_rateest module. This vulnerability occurs on network links operating at speeds of approximately 34 Gigabits per second (Gbps) or faster. Due to an integer truncation issue, the system incorrectly calculates the actual network traffic rate. This can lead to inaccurate rate estimations, potentially disrupting network traffic management and causing unexpected network behavior.

This vulnerability is rated as Moderate severity because it requires high-throughput interfaces and active rate estimator firewall rules to trigger, limiting the scope of impact to inaccurate packet matching and potential traffic management disruption rather than arbitrary code execution or memory corruption. In Red Hat Enterprise Linux environments, the xt_rateest netfilter module is not loaded by default and is only engaged when custom packet-filtering configurations explicitly invoke the rateest match extension. Additionally, the truncation behavior only manifests under sustained bandwidth surpassing approximately 34 Gbps, meaning standard enterprise workloads and lower-speed network adapters remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.