CVE-2026-74564
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the Linux kernel, netfilter xt_hashlimit has a vulnerability due to uninitialized access to the burst field in the union of the dsthash_ent structure when XT_HASHLIMIT_RATE_MATCH mode is used by fewer than two rules referring to the same hashtable. Additionally, this mode is rejected for revisions less than 3.
Risk Assessment
The vulnerability could lead to unpredictable behavior or information disclosure, and potentially privilege escalation if an attacker can configure xt_hashlimit rules.
Recommendation
Apply the Linux kernel patch that adds validation in .checkentry for XT_HASHLIMIT_RATE_MATCH mode. Update your system to a kernel version containing this fix.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH The XT_HASHLIMIT_RATE_MATCH flag mode changes the semantics of the dsthash_ent structure which represents an entry in the hashtable. There is a union area which uses a different layout to express the rate match mode. Update .checkentry path to validate the XT_HASHLIMIT_RATE_MATCH mode flag is requested by two or more different rules that refer to the same hashtable. Otherwise, uninitialized access to the burst field in the union is possible. Reject the use of the XT_HASHLIMIT_RATE_MATCH mode flag if set on by revision less than 3 too.