CVE-2026-74579

A flaw was found in the Linux kernel's netfilter subsystem. The nft_payload_offload_mask() function, which builds offload match masks for network packet header fields, contains a shift-out-of-bounds error. This occurs when processing partial IPv6 address matches, leading to an incorrect mask calculation and undefined behavior. This vulnerability could potentially result in a denial of service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.