CVE-2026-52921 netfilter: ipset: stop hash:* range iteration at end

🗓️ 24 Jun 2026 07:14:16Reported by LinuxType

Fix netfilter ipset IPv4 range iteration to stop at end and prevent overrun beyond range.

Reporter	Title	Published	Views	Family All 14
ATTACKERKB	CVE-2026-52921	24 Jun 202607:14	–	attackerkb
CVE	CVE-2026-52921	24 Jun 202607:14	–	cve
Debian CVE	CVE-2026-52921	24 Jun 202607:14	–	debiancve
EUVD	EUVD-2026-38724	24 Jun 202607:14	–	euvd
NVD	CVE-2026-52921	24 Jun 202608:16	–	nvd
OSV	BELL-CVE-2026-52921	25 Jun 202606:11	–	osv
OSV	DEBIAN-CVE-2026-52921	24 Jun 202608:16	–	osv
OSV	ECHO-DC3B-7524-1EA6	25 Jun 202602:19	–	osv
OSV	ROOT-OS-UBUNTU-2204-CVE-2026-52921 CVE-2026-52921 in rootio-linux - Patched by Root	27 Jun 202607:27	–	osv
OSV	UBUNTU-CVE-2026-52921	24 Jun 202608:16	–	osv

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "net/netfilter/ipset/ip_set_hash_ipmark.c",
      "net/netfilter/ipset/ip_set_hash_ipport.c",
      "net/netfilter/ipset/ip_set_hash_ipportip.c",
      "net/netfilter/ipset/ip_set_hash_ipportnet.c"
    ],
    "versions": [
      {
        "version": "48596a8ddc46f96afb6a2cd72787cb15d6bb01fc",
        "lessThan": "be75218fadea22e59c8673db212f29c681bf45bb",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "48596a8ddc46f96afb6a2cd72787cb15d6bb01fc",
        "lessThan": "383418c20e69f5761b6ec5238f599423f4fb77fb",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "48596a8ddc46f96afb6a2cd72787cb15d6bb01fc",
        "lessThan": "0d7b33ace701fe397e6e4de145f32e098178d901",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "48596a8ddc46f96afb6a2cd72787cb15d6bb01fc",
        "lessThan": "c281e018af98df91827d65bec00f4956c00a1b02",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "48596a8ddc46f96afb6a2cd72787cb15d6bb01fc",
        "lessThan": "02f75f041a93ea045834da89cd3234f4c1d749b4",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "48596a8ddc46f96afb6a2cd72787cb15d6bb01fc",
        "lessThan": "952e988163c2ab9939c3db9f0f8e77af6a1bb436",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "48596a8ddc46f96afb6a2cd72787cb15d6bb01fc",
        "lessThan": "0b530efb2cc9dbdddfd49d392e3a857f0d4ce8dc",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "48596a8ddc46f96afb6a2cd72787cb15d6bb01fc",
        "lessThan": "0d3a282ab5f165fc207ff49ea5b6ad8f54616bd6",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "net/netfilter/ipset/ip_set_hash_ipmark.c",
      "net/netfilter/ipset/ip_set_hash_ipport.c",
      "net/netfilter/ipset/ip_set_hash_ipportip.c",
      "net/netfilter/ipset/ip_set_hash_ipportnet.c"
    ],
    "versions": [
      {
        "version": "4.14",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "4.14",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.10.258",
        "lessThanOrEqual": "5.10.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.15.209",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.1.175",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.6.142",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.12.92",
        "lessThanOrEqual": "6.12.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.18.34",
        "lessThanOrEqual": "6.18.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.0.11",
        "lessThanOrEqual": "7.0.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.1",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]

Source	Link
git	www.git.kernel.org/stable/c/0d7b33ace701fe397e6e4de145f32e098178d901
git	www.git.kernel.org/stable/c/02f75f041a93ea045834da89cd3234f4c1d749b4
git	www.git.kernel.org/stable/c/0b530efb2cc9dbdddfd49d392e3a857f0d4ce8dc
git	www.git.kernel.org/stable/c/0d3a282ab5f165fc207ff49ea5b6ad8f54616bd6
git	www.git.kernel.org/stable/c/383418c20e69f5761b6ec5238f599423f4fb77fb
git	www.git.kernel.org/stable/c/952e988163c2ab9939c3db9f0f8e77af6a1bb436
git	www.git.kernel.org/stable/c/c281e018af98df91827d65bec00f4956c00a1b02
git	www.git.kernel.org/stable/c/be75218fadea22e59c8673db212f29c681bf45bb

24 Jun 2026 07:14Current

EPSS0.00164