CVE-2026-72436

A flaw was found in the netfilter: ipset component of the Linux kernel. This vulnerability occurs because a specific operation, test_bit(), is used in a way that lacks proper safeguards when multiple processes access shared data simultaneously. This can lead to situations where the system processes data incorrectly or behaves unexpectedly. Such issues could potentially result in data corruption or make the system unavailable (Denial of Service).

Lockless RCU readers in netfilter ipset hash types used relaxed test_bit() while the same hash data may be updated by add, delete, or garbage collection paths. This can allow a reader to observe the used bit without the required acquire ordering and then read hash element data in an inconsistent state. For the CVSS the PR:N is used in the paranoid score because packet matching can exercise the reader path remotely when an ipset backed firewall rule is reachable, while the required concurrent update or gc makes exploitation timing dependent. The issue is network reachable only in configurations where ipset is used in packet filtering and the set is modified or garbage collected in parallel. Impact is primarily a limited filtering integrity risk and possible denial of service rather than proven privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.